AI-Ready Ubuntu 24.04 LTS (NVIDIA GPU) | Support by Clearscale

ClearImages AI-Ready Ubuntu 24.04 LTS is a turn-key, GPU-enabled AMI that serves a private, bearer-token-gated LLM endpoint - both Ollama-native and OpenAI-compatible - inside your own VPC, with no Kubernetes or hand-assembled GPU stack. It is built on the CIS Level 1 Ubuntu 24.04 LTS baseline; the sections below are how you configure and use it.

Configure with cloud-init (8-key schema) Pass an ai-edge intake JSON via cloud-init user-data to /var/lib/clearimages/firstboot/ai-edge-intake.json. Set any subset; omitted keys take baked defaults.
- model_name - Ollama model tag to serve (default qwen3:1.7b-q4_K_M). First boot runs ollama pull for any non-default tag (needs outbound to ollama.com / huggingface.co); on failure the baked model keeps serving. Examples: qwen3:8b-q4_K_M, llama3.2:3b, phi3.5-mini.
- api_auth_token - bearer token for the endpoint. Omit to auto-generate (stored at /etc/ai-edge/api-token), or resolve from SSM / Secrets Manager (below).
- api_bind_mode - loopback | private | public (default loopback).
- api_port - HTTPS listen port (default 443).
- tls_mode - self-signed | acme | off (default self-signed).
- acme_domain - FQDN for ACME / Let's Encrypt when tls_mode=acme.
- max_concurrent_requests - per-IP concurrency cap (default 2).
- max_prompt_bytes - max request body in bytes (default 131072 / 128 KiB). Example user-data:
#cloud-config
write_files:
- path: /var/lib/clearimages/firstboot/ai-edge-intake.json
  content: '{"model_name":"qwen3:8b-q4_K_M","api_bind_mode":"public"}'

Use a token without plaintext (SSM / Secrets Manager) Instead of api_auth_token, set a resolver in /etc/clearimages/firstboot.conf via user-data and attach an IAM instance profile with ssm:GetParameter (or secretsmanager:GetSecretValue):
CLEARIMAGES_RESOLVERS=("env:AI_API_AUTH_TOKEN=ssm:/your/path/api_token")

Access the model (two API schemas, one port) Caddy reverse-proxies both API surfaces on api_port (default 443); every request requires the header Authorization: Bearer <token>. Self-signed TLS means callers pass curl -k (or trust the cert).
- Ollama-native /api/* : /api/generate, /api/chat, /api/embeddings, /api/tags.
- OpenAI-compatible /v1/* : /v1/chat/completions, /v1/completions, /v1/embeddings, /v1/models - a drop-in base_url for OpenAI SDKs. Examples:
curl -k -H "Authorization: Bearer $TOKEN" -d '{"model":"qwen3:1.7b-q4_K_M","prompt":"2+2=","stream":false}' https://<IP>/api/generate
curl -k -H "Authorization: Bearer $TOKEN" -d '{"model":"qwen3:1.7b-q4_K_M","messages":[{"role":"user","content":"hi"}]}' https://<IP>/v1/chat/completions

Manage models at runtime (ai-edge CLI)
sudo ai-edge status - driver / GPU, Ollama, Caddy, and model health.
sudo ai-edge swap-model qwen3:8b-q4_K_M - pull and switch the served model live.
sudo ai-edge token show - print the active bearer token; to rotate, update the SSM parameter then restart clearimages-firstboot.service.

What is included: NVIDIA 580 open-kernel driver + CUDA 13.2 (pinned), Ollama 0.12.11 (loopback:11434 under systemd confinement: NoNewPrivileges, ProtectSystem=strict, scoped /dev/nvidia*), Caddy 443 edge proxy (bearer auth, per-IP rate limit, 128 KiB body cap, TLS 1.2+), and Qwen3-1.7B (Q4_K_M, ~1 GiB) baked in for an instant first response.

Hardened and audit-ready: IMDSv2 enforced, encrypted gp3 root, ENA; CIS Level 1 baseline; root SSH and password authentication disabled.

GPU instances: x86_64 g4dn, g5, g6, g6e (NVIDIA T4 / A10G / L4 / L40S); g4dn.xlarge is a good start. A companion ARM listing covers Graviton g5g (NVIDIA T4G). GPU instance types only.

Note: Preview release. vLLM, Open WebUI, customer-supplied model upload, and Inferentia / Trainium variants are not included in this version.