Catalog / API gateways & app servers

WSO2 Integrator MI

ESB and integration runtime with a web control plane

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

Azure Marketplace4.6.0↗
Availability and pricing
CloudVersionSoftware priceLast build
Azure Marketplace
VM image · plan payg-gen2 · Gen2
4.6.0$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-08-10Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseApache-2.0
UpstreamWSO2 LLC
Machine-readableproduct.json · catalog.json
What is WSO2 Integrator MI

WSO2 Integrator: MI (formerly WSO2 Micro Integrator) is an open-source enterprise service bus and integration runtime that connects APIs, services, databases, SaaS platforms and legacy systems. It runs on the JVM (Eclipse Temurin 21) and mediates messages between protocols and formats: REST and SOAP services, JMS and RabbitMQ queues, file and FTP transfers, scheduled tasks, and database-backed data services. Integrations are declared as Synapse artifacts - REST APIs, proxy services, sequences, endpoints, message stores and message processors - and are deployed either as composite applications built with the WSO2 Integrator extension for Visual Studio Code or by dropping a Synapse XML file into the runtime's hot-deploy directory. Configuration and artifacts persist on the instance filesystem; no external database is required. This image also bundles the WSO2 Integration Control Plane, a web console for monitoring the runtime, browsing its deployed artifacts and reading its logs. Apache-2.0 license, no vendor lock-in, no separate enterprise edition and no feature gating.

What the Lynxroute image adds

Security hardening:

  • Per-instance admin passwords generated at first launch - one for the control plane console, a separate one for the runtime management API; the upstream default administrator account is replaced and verified to no longer authenticate
  • TLS keystores regenerated at first launch - upstream ships keystores containing a publicly known private key behind a published password; this image generates a fresh 2048-bit key pair and re-secures both trust stores
  • All web console signing keys replaced with per-instance random secrets, so console sessions cannot be forged
  • Administration is HTTPS-only - the plaintext management port is disabled outright, and TLS is restricted to 1.2 and 1.3 on every listener
  • Control plane internal listeners are reachable only from the instance itself, never from the network
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced
  • fail2ban and AppArmor pre-configured
  • UFW firewall pre-configured - only TCP 22, 8253, 9164 and 9446 are open

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/wso2mi-credentials.txt.

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer wso2mi --plan payg-gen2
az vm create -g my-rg -n wso2mi --size Standard_D2s_v3 \
  --image lynxroute:wso2mi:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

WSO2 Integrator MI 4.6.0 - Initial release (August 2026)

Azure · 2026-08-10
  • WSO2 Integrator: MI 4.6.0 with Integration Control Plane 2.0.0 on Ubuntu 24.04 LTS
  • Eclipse Temurin 21 JDK - the runtime requires JDK 21 or later
  • CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
  • CVE-scanned before every release
  • Separate admin passwords generated per instance for the console and the management API
  • TLS keystores regenerated at first launch, trust stores re-secured
  • Web console signing keys replaced with per-instance random secrets
  • Management API restricted to HTTPS; plaintext management port disabled
  • TLS 1.2 and 1.3 only on every listener
  • The runtime registers itself with the control plane console automatically
  • No external database required - artifacts and configuration persist on the instance
  • UFW firewall pre-configured (ports 22, 8253, 9164, 9446 only)
  • fail2ban, auditd, AppArmor pre-configured
  • SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
  • CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
  • IMDSv2 enforced