Availability and pricing

Cloud	Version	Software price	Last build
AWS Marketplace EC2 AMI · all commercial regions	4.20.0	$0.05/hr Recommended instance: t3.large · 5-day free trial	2026-10-23	Listing ↗
Azure Marketplace VM image · plan payg-gen2 · Gen2	4.19.4	$0.028/vCPU/hr Recommended VM: Standard_D2s_v3	2026-10-02	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	AGPL-3.0-only
Upstream	Zitadel (CAOS Ltd.)
Machine-readable	product.json · catalog.json

What is Zitadel

Zitadel is an open-source identity and access management platform: it authenticates your users and issues tokens for your own applications over the standards they already speak. It is a single statically linked Go binary that serves the API and the admin Console, paired with a hosted login UI, and this image bundles the PostgreSQL 17 event store it needs. Feature blocks include OpenID Connect 1.0, OAuth 2.0 with the device and token-exchange flows, SAML 2.0, SCIM 2.0 provisioning, passwords, passkeys/WebAuthn and time-based one-time codes, plus multiple organizations inside one instance for multi-tenant products. Zitadel is event-sourced - every change is appended to an immutable event log in PostgreSQL, so the audit trail is the storage model rather than an add-on, and ordinary PostgreSQL backup and replication tooling applies directly. AGPL-3.0 license, no vendor lock-in: the issuer is a hostname you control, so you can rebuild or move the deployment without every relying party re-integrating.

What the Lynxroute image adds

Security hardening:

No credentials are baked into the image - the administrator password, the PostgreSQL application and superuser passwords, and the encryption master key that protects every stored secret are all generated on the instance at first launch and written to /root/zitadel-credentials.txt
Self-registration is disabled, so anonymous visitors cannot create their own accounts in your directory; it can be enabled from the Console when you want public sign-up
A unique TLS certificate is generated on each instance at first launch, carrying that instance's address - no private key is shared between deployments
TLS is terminated at the perimeter on 443 in front of the Console, the OIDC/OAuth2/SAML/SCIM endpoints and gRPC; the application ports are not reachable from the network
Bundled PostgreSQL 17 bound to 127.0.0.1 only, SCRAM-SHA-256 authentication, no trust authentication anywhere, and blocked externally in the firewall
Login and consent screens cannot be framed (X-Frame-Options DENY), which blocks the classic consent-clickjacking attack against an identity provider
Usage reporting is switched off - nothing leaves the instance
The encryption master key is stored root-only and the login service cannot read it, so a compromise of the login process does not expose stored secrets
UFW firewall pre-configured - TCP 22, 80 and 443 open; the API port, the login service port and PostgreSQL blocked
fail2ban, AppArmor
CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown, with a documented tailored profile
auditd, SSH hardening (key-only, no password authentication), Kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
AGPL-3.0 license text and the exact upstream revision this image was built from at /usr/share/doc/lynxroute/LICENSES.txt

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/zitadel-credentials.txt.

AWS CLIAzure CLI

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-t7ciekoxedxe6/latest \
  --instance-type t3.large --key-name my-key --security-group-ids sg-xxxxxxxx

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer zitadel --plan payg-gen2
az vm create -g my-rg -n zitadel --size Standard_D2s_v3 \
  --image lynxroute:zitadel:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

Zitadel

Launch in one command

Latest release

Zitadel 4.20.0