{
 "slug": "superset",
 "name": "Apache Superset",
 "tagline": "BI and data exploration platform with SQL Lab and interactive dashboards",
 "category": "analytics-bi",
 "use_cases": [
  "business-intelligence",
  "dashboards",
  "data-exploration"
 ],
 "aliases": [
  "apache superset"
 ],
 "status": "live",
 "upstream": {
  "vendor": "The Apache Software Foundation",
  "url": "https://superset.apache.org",
  "license": "Apache-2.0",
  "license_url": "https://github.com/apache/superset/blob/master/LICENSE.txt"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "6.1.0",
   "last_build": "2026-09-04",
   "entity_id": "prod-a7j3xty64rhsq",
   "ami_alias": "/aws/service/marketplace/prod-a7j3xty64rhsq/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-xauzgddjra6hu",
   "recommended_instance_type": "t3.large",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "6.1.0",
   "last_build": "2026-08-10",
   "offer_id": "superset",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:superset:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.superset?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/superset/",
  "json": "https://lynxroute.com/products/superset/product.json"
 },
 "release_notes": [
  {
   "version": "6.1.0",
   "title": "Apache Superset v6.1.0",
   "notes": "* Re-release of Apache Superset 6.1.0. The application version is unchanged; this build refreshes the underlying operating system image\n* Production stack, not the upstream development compose file: Gunicorn (gevent workers) + Celery worker + Celery beat + bundled PostgreSQL metadata database + bundled Valkey for the Celery broker, result backend and all caches\n* Nginx TLS perimeter with a self-signed certificate; Certbot pre-installed - enable a real certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-04",
    "azure": "2026-08-10"
   }
  },
  {
   "version": "6.1.0",
   "title": "Apache Superset 6.1.0 - Initial release (August 2026)",
   "notes": "* Apache Superset 6.1.0 on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* No credentials in the image - the admin password, the database password and the Flask secret key are generated on your instance at first launch\n* Warehouse credentials saved in Superset are encrypted at rest with the per-instance secret key\n* Production stack: Gunicorn with gevent workers, Celery worker and scheduler, bundled PostgreSQL metadata database, bundled Valkey for the task broker, results backend and caches\n* Worker pools sized automatically from the instance CPU and memory\n* PostgreSQL and Valkey bound to 127.0.0.1 only\n* Self-registration disabled; accounts are created by an administrator\n* nginx TLS with a self-signed certificate and HTTP-to-HTTPS redirect; Certbot pre-installed\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-04",
    "azure": "2026-08-10"
   }
  }
 ],
 "release_history": [
  {
   "version": "6.1.0",
   "aws": "2026-09-04",
   "azure": "2026-08-10"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-a7j3xty64rhsq/latest \\\n  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer superset --plan payg-gen2\naz vm create -g my-rg -n superset --size Standard_D2s_v3 \\\n  --image lynxroute:superset:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Apache Superset is a business intelligence and data exploration platform from the Apache Software Foundation, built in Python on Flask with a React front end. It connects to any SQL-speaking datastore through SQLAlchemy - PostgreSQL, MySQL, Snowflake, Trino, ClickHouse, Druid and dozens more - and turns queries into interactive charts and dashboards. It offers SQL Lab as a full in-browser query IDE, a no-code Explore view for building charts without SQL, more than 50 visualization types, a semantic layer for reusable metrics, row-level security, dashboard filtering, alerting hooks and scheduled cache warm-up. Chart, dashboard and user metadata persists in PostgreSQL; query results and the task queue live in Valkey. Apache-2.0 license, no vendor lock-in - and because it is governed by the ASF there is no commercial edition holding features back.",
  "image_adds": "Security hardening:\n* No credentials in the image - the admin password, the PostgreSQL password and the Flask secret key are all generated on your instance at first launch\n* The per-instance secret key encrypts every warehouse credential you save in Superset, so a copy of the image cannot decrypt them\n* PostgreSQL and Valkey bound to 127.0.0.1 only - not reachable from the network\n* The application server listens on loopback; nginx is the only process facing the network\n* Self-registration disabled - accounts are created by an administrator\n* TLS enabled from the first launch with a self-signed certificate and an HTTP-to-HTTPS redirect, plus Certbot pre-installed for a CA-signed certificate\n* UFW firewall pre-configured - only 22, 80 and 443 open\n* fail2ban and AppArmor pre-configured\n* CVE scan - every image is scanned for vulnerabilities before release\n\nA production stack, not a development sample:\n* Gunicorn with gevent workers, the asynchronous configuration the Superset documentation recommends\n* Celery worker and scheduler for asynchronous SQL Lab queries and scheduled tasks\n* Worker pools sized automatically from the instance CPU and memory at first launch\n* PostgreSQL as the metadata database rather than the SQLite default, which the project discourages for production\n* Valkey backing the task broker, the results backend and all four caches on separate logical databases\n* A loading page while the database is prepared on first launch, instead of a connection error\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown, with a documented tailored profile\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}