Availability and pricing

Cloud	Version	Software price	Last build
AWS Marketplace EC2 AMI · all commercial regions	0.27.3	$0.05/hr Recommended instance: m6i.xlarge · 5-day free trial	2026-10-25	Listing ↗
Azure Marketplace VM image · plan payg-gen2 · Gen2	0.27.2	$0.028/vCPU/hr Recommended VM: Standard_D4s_v3	2026-09-13	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	Apache-2.0
Upstream	InfiniFlow
Machine-readable	product.json · catalog.json

What is RAGFlow

RAGFlow is an open-source Retrieval-Augmented Generation engine for enterprise document intelligence. Its deep document understanding layer (deepdoc) parses PDFs, Word, slides, spreadsheets, scanned books and images with layout recognition, table extraction and chunk-level citation tracking - so every answer the LLM produces is traceable back to a paragraph, page, table cell or figure in the original source. RAGFlow ingests files into knowledge bases, builds hybrid vector plus full-text indices in Elasticsearch, stores blobs in MinIO, and exposes a multi-tenant web UI plus REST API plus MCP server for chat, agents, and programmatic retrieval. Supports any LLM provider through a single dropdown - OpenAI, Anthropic Claude, AWS Bedrock, Azure OpenAI, Google Gemini, Cohere, Mistral, DeepSeek, Ollama, vLLM, and many more. Agent workflows let the model browse, run SQL, call tools, and chain retrieval over multiple knowledge bases. Apache-2.0 license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

Self-registration with auto-close - the first user who hits the web UI becomes the workspace owner, then the registration endpoint is closed automatically by a background service
No baked-in admin email, no default credentials shipped on disk - the customer owns the identity layer
MySQL, Elasticsearch, MinIO and Redis passwords rotated at first boot (>=32 chars each), never baked into the image
Upstream Go admin server (license-tracker module) explicitly NOT enabled - the image runs the pure Apache-2.0 Python server only
Containers bound to the docker bridge - no backing store (MySQL, Elasticsearch, MinIO, Redis) is reachable from outside the host
Nginx reverse proxy with TLS, HTTP-to-HTTPS redirect, WebSocket support for streaming chat, security headers
UFW firewall pre-configured - only TCP 22, 80, 443 are exposed
fail2ban, AppArmor
CVE scan - every image is scanned for vulnerabilities before release

Out of the box, with no external services:

Elasticsearch 8.11.3 vector + full-text store with xpack.security enabled
Embedding model bundled inside the upstream ragflow image - no external embedding API key required
MinIO blob store for document originals
MySQL 8 for users, tenants, knowledge bases, datasets
Valkey 8 (BSD-3, OSS Redis fork) for cache + task queue

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, SSH hardening, kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/ragflow-credentials.txt.

AWS CLIAzure CLI

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-lu3xmzzxvf7hs/latest \
  --instance-type m6i.xlarge --key-name my-key --security-group-ids sg-xxxxxxxx

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer ragflow --plan payg-gen2
az vm create -g my-rg -n ragflow --size Standard_D4s_v3 \
  --image lynxroute:ragflow:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

RAGFlow 0.27.3

AWS · 2026-10-25

RAGFlow 0.27.3 on Ubuntu 24.04 LTS - patch update from 0.27.2. Apache-2.0 unchanged
Retrieval paging past 64 results over MCP, document_ids filtering in the agent retrieval node, and reranking on natural chunk text
Adds a Feishu Wiki data-source connector, deletable parser-operator files in pipelines, and HTML-fragment parsing
Fixes dataset-scoped authorization for task cancellation and document download, IPv6 transition addresses in the SSRF URL guard, and retries transient S3 storage failures
Fixes QA pairs dropped from multiline table cells, large sparse spreadsheet and JSON BOM parsing, and a DOCX preview update loop
Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com
Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates