{
 "slug": "rundeck",
 "name": "Rundeck",
 "tagline": "Runbook automation and job scheduler for operations teams",
 "category": "workflow-cicd",
 "use_cases": [
  "runbook-automation",
  "job-scheduling",
  "self-service-ops"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "PagerDuty, Inc.",
  "url": "https://github.com/rundeck/rundeck",
  "license": "Apache-2.0",
  "license_url": "https://github.com/rundeck/rundeck/blob/main/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "restricted",
   "restricted_on": "2026-08-24"
  },
  "azure": {
   "status": "live",
   "version": "6.2.1",
   "last_build": "2026-09-13",
   "offer_id": "rundeck",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:rundeck:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.rundeck?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/rundeck/",
  "json": "https://lynxroute.com/products/rundeck/product.json"
 },
 "release_notes": [
  {
   "version": "6.1.0",
   "title": "Rundeck 6.1.0 - Initial release (August 2026)",
   "notes": "* Rundeck 6.1.0 on Ubuntu 24.04 LTS (OpenJDK 17)\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Random admin password generated at first launch and stored only as a digest - the packaged default login is removed\n* Per-instance key storage and project configuration encryption keys generated at first launch\n* Bundled PostgreSQL bound to 127.0.0.1 with a randomly generated role password, replacing the file-based database that upstream supports for testing only\n* Rundeck bound to 127.0.0.1:4440; nginx terminates TLS on port 443\n* Per-instance REST API token generated at first launch for automation\n* JVM heap auto-sized to the instance RAM; temp kept off noexec /tmp\n* Runs as non-root rundeck user (UMask 0027)\n* certbot pre-installed for CA-signed TLS certificates\n* UFW firewall pre-configured (ports 22, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "azure": "2026-08-06"
   }
  }
 ],
 "release_history": [
  {
   "version": "6.2.1",
   "azure": "2026-09-13"
  },
  {
   "version": "6.1.0",
   "azure": "2026-08-06"
  }
 ],
 "deploy": {
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer rundeck --plan payg-gen2\naz vm create -g my-rg -n rundeck --size Standard_D2s_v3 \\\n  --image lynxroute:rundeck:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Rundeck is an open-source runbook automation and job scheduling server: it turns the scripts and procedures an operations team already runs by hand into jobs that any authorised user can run from a browser, the REST API, or a schedule. It is a Java application (a single WAR on the JVM with an embedded web server) built around projects, node inventories, and workflows: a job is a sequence of shell commands, scripts, or plugin steps, optionally parameterised with options, dispatched across nodes over SSH, with per-execution logs retained for audit. Access is governed by role-based ACL policies, so routine operations - restarts, backups, provisioning, data fixes - can be delegated without handing out SSH keys or shell access. Rundeck persists projects, jobs, executions, and encrypted key storage in a relational database; this image bundles PostgreSQL for that purpose. Apache-2.0 license, no vendor lock-in.",
  "image_adds": "Security hardening:\n* No default credentials - the packaged admin/admin login is removed and a random 24-character admin password is generated at first launch, stored only as a digest and surfaced to /root/rundeck-credentials.txt (mode 600)\n* Per-instance encryption keys - the key storage and project configuration encryption passwords are regenerated at first launch, so no two instances share a secret\n* Bundled PostgreSQL bound to 127.0.0.1 only, with its own randomly generated role password - the file-based database that ships by default is not supported by the project for production use\n* Rundeck bound to 127.0.0.1:4440 (loopback only); nginx terminates TLS on port 443 and reverse-proxies to it - the application port is never exposed\n* A per-instance REST API token generated at first launch for automation, revocable in one line\n* certbot pre-installed - one command swaps the self-signed certificate for a CA-signed one\n* JVM heap auto-sized to the instance RAM at first launch; temp directory kept off the noexec /tmp so job scripts run cleanly\n* Runs as a non-root rundeck system user with UMask 0027\n* UFW firewall pre-configured (only ports 22 and 443 open)\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md\n\nRundeck is a trademark of PagerDuty, Inc. This is an independently hardened build of the open-source project, not affiliated with or endorsed by PagerDuty, Inc."
 },
 "generated_at": "2026-10-31T09:36:34Z"
}