Catalog / CI/CD & workflow orchestration

Rundeck

Runbook automation and job scheduler for operations teams

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

Azure Marketplace6.2.1↗
Availability and pricing
CloudVersionSoftware priceLast build
Azure Marketplace
VM image · plan payg-gen2 · Gen2
6.2.1$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-09-13Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseApache-2.0
UpstreamPagerDuty, Inc.
Machine-readableproduct.json · catalog.json
What is Rundeck

Rundeck is an open-source runbook automation and job scheduling server: it turns the scripts and procedures an operations team already runs by hand into jobs that any authorised user can run from a browser, the REST API, or a schedule. It is a Java application (a single WAR on the JVM with an embedded web server) built around projects, node inventories, and workflows: a job is a sequence of shell commands, scripts, or plugin steps, optionally parameterised with options, dispatched across nodes over SSH, with per-execution logs retained for audit. Access is governed by role-based ACL policies, so routine operations - restarts, backups, provisioning, data fixes - can be delegated without handing out SSH keys or shell access. Rundeck persists projects, jobs, executions, and encrypted key storage in a relational database; this image bundles PostgreSQL for that purpose. Apache-2.0 license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • No default credentials - the packaged admin/admin login is removed and a random 24-character admin password is generated at first launch, stored only as a digest and surfaced to /root/rundeck-credentials.txt (mode 600)
  • Per-instance encryption keys - the key storage and project configuration encryption passwords are regenerated at first launch, so no two instances share a secret
  • Bundled PostgreSQL bound to 127.0.0.1 only, with its own randomly generated role password - the file-based database that ships by default is not supported by the project for production use
  • Rundeck bound to 127.0.0.1:4440 (loopback only); nginx terminates TLS on port 443 and reverse-proxies to it - the application port is never exposed
  • A per-instance REST API token generated at first launch for automation, revocable in one line
  • certbot pre-installed - one command swaps the self-signed certificate for a CA-signed one
  • JVM heap auto-sized to the instance RAM at first launch; temp directory kept off the noexec /tmp so job scripts run cleanly
  • Runs as a non-root rundeck system user with UMask 0027
  • UFW firewall pre-configured (only ports 22 and 443 open)
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Rundeck is a trademark of PagerDuty, Inc. This is an independently hardened build of the open-source project, not affiliated with or endorsed by PagerDuty, Inc.

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/rundeck-credentials.txt.

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer rundeck --plan payg-gen2
az vm create -g my-rg -n rundeck --size Standard_D2s_v3 \
  --image lynxroute:rundeck:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Rundeck 6.1.0 - Initial release (August 2026)

Azure · 2026-08-06
  • Rundeck 6.1.0 on Ubuntu 24.04 LTS (OpenJDK 17)
  • CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
  • CVE-scanned before every release
  • Random admin password generated at first launch and stored only as a digest - the packaged default login is removed
  • Per-instance key storage and project configuration encryption keys generated at first launch
  • Bundled PostgreSQL bound to 127.0.0.1 with a randomly generated role password, replacing the file-based database that upstream supports for testing only
  • Rundeck bound to 127.0.0.1:4440; nginx terminates TLS on port 443
  • Per-instance REST API token generated at first launch for automation
  • JVM heap auto-sized to the instance RAM; temp kept off noexec /tmp
  • Runs as non-root rundeck user (UMask 0027)
  • certbot pre-installed for CA-signed TLS certificates
  • UFW firewall pre-configured (ports 22, 443 only)
  • fail2ban, auditd, AppArmor pre-configured
  • SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
  • CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
  • IMDSv2 enforced