Catalog / Messaging & streaming

RabbitMQ

Multi-protocol message broker with the management UI

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
4.4.0$0.05/hr
Recommended instance: t3.medium · 5-day free trial
2026-10-24Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
4.3.6$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-09-20Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseMPL-2.0
UpstreamBroadcom (Team RabbitMQ)
Machine-readableproduct.json · catalog.json
What is RabbitMQ

RabbitMQ is an open-source message broker from Team RabbitMQ (Broadcom), implemented in Erlang/OTP and one of the most widely deployed brokers for the AMQP 0-9-1 protocol, with STOMP, MQTT, and WebSocket support via plugins. It routes messages between producers and consumers through exchanges, queues, and bindings, supporting work queues, publish/subscribe, routing, topics, and request/reply, with durable queues, publisher confirms, consumer acknowledgements, dead-lettering, TTLs, and quorum queues for replicated, fault-tolerant delivery. A bundled web management UI provides queue, exchange, connection, and user administration plus live metrics over an HTTP API. Broker state (virtual hosts, queues, users, and persistent messages) is stored on the local filesystem. This image runs a single node on Erlang/OTP 27. MPL-2.0 license - a self-hosted alternative to hosted queue services, with no per-message fees and no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • Unique admin user (administrator tag) generated per instance at first boot; the default guest/guest account is deleted
  • A per-instance Erlang cookie generated at first boot (not a shared baked-in secret)
  • Management UI bound to 127.0.0.1 only, behind an nginx TLS reverse proxy on 443; RabbitMQ enforces its own login
  • Native AMQPS (TLS) on 5671 with a per-instance self-signed certificate; plaintext AMQP on 5672
  • UFW firewall - ports 22 (SSH), 443 (management UI), 5672 (AMQP), 5671 (AMQPS) only
  • fail2ban, AppArmor
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/rabbitmq-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-kgy7vj2fy7xn2/latest \
  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer rabbitmq --plan payg-gen2
az vm create -g my-rg -n rabbitmq --size Standard_D2s_v3 \
  --image lynxroute:rabbitmq:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

RabbitMQ 4.3.3 - July 2026

AWS · 2026-07-21Azure · 2026-07-22
  • RabbitMQ 4.3.3 on Ubuntu 24.04 LTS - version update from 4.3.2 (security and bugfix patch; no breaking changes, no migration)
  • Security fixes: cryptographically secure random salts for password hashing, safer management UI template escaping, tighter JMS selector limits, and an OAuth2 sign-in fix for Safari
  • Minimum Erlang/OTP raised to 27.0+ (OTP 26 is end-of-life) - this image already runs Erlang/OTP 27.3.4.14
  • Invalid consumer_timeout values now fall back to the 24-hour default; new optional stream.max_super_stream_partitions setting (default 1000)
  • Bundled ra 3.1.9 and cowboy 2.17.0; MPL-2.0 license unchanged
  • Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base
  • CVE-scanned before every release