Availability and pricing

Cloud	Version	Software price	Last build
AWS Marketplace EC2 AMI · all commercial regions	11.0.27	$0.05/hr Recommended instance: t3.medium · 5-day free trial	2026-10-23	Listing ↗
Azure Marketplace VM image · plan payg-gen2 · Gen2	11.0.26	$0.028/vCPU/hr Recommended VM: Standard_D2s_v3	2026-09-16	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	Apache-2.0
Upstream	Apache Software Foundation
Machine-readable	product.json · catalog.json

What is Apache Tomcat

Apache Tomcat is the world's most widely deployed Java application server and the reference implementation of the Jakarta EE Servlet, JSP, Expression Language, WebSocket and Authentication specifications, maintained by the Apache Software Foundation. Tomcat 11 targets Jakarta EE 11 (the jakarta.* namespace, not the legacy javax.*) and requires Java 17 or newer. It runs servlet/JSP web applications and WAR files with a small footprint, fast startup and a mature, battle-tested codebase. This image ships the official Apache binary distribution (verified against the upstream SHA-512 checksum) running on OpenJDK 17, as a non-root service. Apache-2.0 license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

HTTP connector bound to 127.0.0.1:8080 (loopback only); nginx terminates TLS on port 443 and reverse-proxies to it - port 8080 is never exposed
Manager and Host-Manager webapps are never reachable from the internet (nginx returns 403 at the perimeter, and Tomcat additionally restricts them to localhost connections)
Manager admin password generated uniquely at first boot, written to /root/tomcat-credentials.txt (mode 600)
The insecure bundled "examples" webapp (sample servlets with known demo vulnerabilities) is removed
Runs as a non-root tomcat system user with UMask 0027
JVM heap (-Xms/-Xmx) auto-sized to the instance RAM at first boot
UFW firewall pre-configured (only ports 22 and 443 open)
certbot pre-installed - one command swaps the self-signed cert for a CA-signed one
CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/tomcat-credentials.txt.

AWS CLIAzure CLI

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-xgyg5uzu5l2fm/latest \
  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer tomcat --plan payg-gen2
az vm create -g my-rg -n tomcat --size Standard_D2s_v3 \
  --image lynxroute:tomcat:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Apache Tomcat 11.0.27

AWS · 2026-10-23

Apache Tomcat updated 11.0.26 -> 11.0.27. Apache-2.0 unchanged
Security (Important): CVE-2026-103119 (AJP response mix-up), CVE-2026-101356 (HTTP/2 response mix-up) and CVE-2026-101296 (JNDIRealm bind failing open)
Security (Low): CVE-2026-93446, CVE-2026-88041, CVE-2026-74049, CVE-2026-74048
Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build