Availability and pricing

Cloud	Version	Software price	Last build
AWS Marketplace EC2 AMI · all commercial regions	6.1.0	$0.05/hr Recommended instance: t3.large · 5-day free trial	2026-09-04	Listing ↗
Azure Marketplace VM image · plan payg-gen2 · Gen2	6.1.0	$0.028/vCPU/hr Recommended VM: Standard_D2s_v3	2026-08-10	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	Apache-2.0
Upstream	The Apache Software Foundation
Machine-readable	product.json · catalog.json

What is Apache Superset

Apache Superset is a business intelligence and data exploration platform from the Apache Software Foundation, built in Python on Flask with a React front end. It connects to any SQL-speaking datastore through SQLAlchemy - PostgreSQL, MySQL, Snowflake, Trino, ClickHouse, Druid and dozens more - and turns queries into interactive charts and dashboards. It offers SQL Lab as a full in-browser query IDE, a no-code Explore view for building charts without SQL, more than 50 visualization types, a semantic layer for reusable metrics, row-level security, dashboard filtering, alerting hooks and scheduled cache warm-up. Chart, dashboard and user metadata persists in PostgreSQL; query results and the task queue live in Valkey. Apache-2.0 license, no vendor lock-in - and because it is governed by the ASF there is no commercial edition holding features back.

What the Lynxroute image adds

Security hardening:

No credentials in the image - the admin password, the PostgreSQL password and the Flask secret key are all generated on your instance at first launch
The per-instance secret key encrypts every warehouse credential you save in Superset, so a copy of the image cannot decrypt them
PostgreSQL and Valkey bound to 127.0.0.1 only - not reachable from the network
The application server listens on loopback; nginx is the only process facing the network
Self-registration disabled - accounts are created by an administrator
TLS enabled from the first launch with a self-signed certificate and an HTTP-to-HTTPS redirect, plus Certbot pre-installed for a CA-signed certificate
UFW firewall pre-configured - only 22, 80 and 443 open
fail2ban and AppArmor pre-configured
CVE scan - every image is scanned for vulnerabilities before release

A production stack, not a development sample:

Gunicorn with gevent workers, the asynchronous configuration the Superset documentation recommends
Celery worker and scheduler for asynchronous SQL Lab queries and scheduled tasks
Worker pools sized automatically from the instance CPU and memory at first launch
PostgreSQL as the metadata database rather than the SQLite default, which the project discourages for production
Valkey backing the task broker, the results backend and all four caches on separate logical databases
A loading page while the database is prepared on first launch, instead of a connection error

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown, with a documented tailored profile
auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/superset-credentials.txt.

AWS CLIAzure CLI

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-a7j3xty64rhsq/latest \
  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer superset --plan payg-gen2
az vm create -g my-rg -n superset --size Standard_D2s_v3 \
  --image lynxroute:superset:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Apache Superset v6.1.0

AWS · 2026-09-04Azure · 2026-08-10

Re-release of Apache Superset 6.1.0. The application version is unchanged; this build refreshes the underlying operating system image
Production stack, not the upstream development compose file: Gunicorn (gevent workers) + Celery worker + Celery beat + bundled PostgreSQL metadata database + bundled Valkey for the Celery broker, result backend and all caches
Nginx TLS perimeter with a self-signed certificate; Certbot pre-installed - enable a real certificate with one command: sudo certbot --nginx -d yourdomain.com
Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build