Availability and pricing

Cloud	Version	Software price	Last build
AWS Marketplace EC2 AMI · all commercial regions	3.4.1	$0.03/hr Recommended instance: t3.small · 5-day free trial	2026-10-24	Listing ↗
Azure Marketplace VM image · plan payg-gen2 · Gen2	3.4.1	$0.028/vCPU/hr Recommended VM: Standard_D2s_v3	2026-10-25	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	MIT
Upstream	Umami Software, Inc.
Machine-readable	product.json · catalog.json

What is Umami

Umami is an open-source, privacy-friendly, self-hosted web analytics platform - a lightweight alternative to Google Analytics and Plausible. It is a Next.js + Node 22 application backed by PostgreSQL 15. It tracks pageviews, sessions, events, referrers, devices, and custom events without setting cookies and without storing personal data, which removes the need for cookie consent banners on most jurisdictions (GDPR, CCPA, PECR). Owners manage multiple sites in one dashboard, share read-only public pages, define custom event tracking, build their own dashboards via Boards, and capture optional session replay. Integrates with any website by pasting a small JavaScript snippet into the <head> - no SDK, no build step, no third-party tracking pixel. Persists pageviews, sessions, events, and dashboards in PostgreSQL 15. MIT license, no vendor lock-in. Self-hosting puts your visitor data entirely under your control, eliminates per-pageview SaaS pricing, and keeps every event on infrastructure you own.

What the Lynxroute image adds

Security hardening:

Seeded admin:umami credential rotated to a random 24-character password at first boot - written to /root/umami-credentials.txt, the rotation verified to no longer authenticate before the image accepts traffic
Umami app bound to 127.0.0.1:3000 only - reachable through the Nginx reverse proxy with TLS, never directly exposed on the host network
PostgreSQL 15 inside the Docker compose bridge - no host port mapping, never reachable on 0.0.0.0:5432
Per-instance PostgreSQL password and APP_SECRET generated at first boot - never baked into the image
Nginx reverse proxy with TLS, HTTP-to-HTTPS redirect, hardened cipher suite, security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy)
UFW firewall pre-configured - only TCP 22, 80, 443 exposed
fail2ban, AppArmor
CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, SSH hardening, kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/umami-credentials.txt.

AWS CLIAzure CLI

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-epjwlrwsai652/latest \
  --instance-type t3.small --key-name my-key --security-group-ids sg-xxxxxxxx

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer umami --plan payg-gen2
az vm create -g my-rg -n umami --size Standard_D2s_v3 \
  --image lynxroute:umami:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Umami 3.4.1

AWS · 2026-10-24Azure · 2026-10-25

Umami updated 3.4.0 -> 3.4.1, a security hotfix release. MIT unchanged
Security: Next.js 16.4.2 fixes a critical remote code execution in next/og, SSRF in image optimization, cache poisoning and an information disclosure issue; React 19.3.1
Container base moves to Node 22.23.4 with the October 2026 Node.js security fixes
Fixes an OAuth credential leak in the Model Context Protocol packages and raises the floors of vulnerable transitive dependencies
No schema migrations
Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates