Grafana on Ubuntu 26.04 by Verified Images

This is a repackaged open source software product wherein additional charges apply for the hardened, security-maintained image (rebuilt and re-verified as new CVEs are disclosed).

Verified Images publishes a hardened, production-ready deployment of Grafana OSS (the open-source observability and dashboards platform for querying, visualizing, and alerting on metrics, logs, and traces) on Ubuntu 26.04 LTS. Grafana runs as a single tuned service behind Caddy for automatic TLS and ships with its built-in database, so you get a running, maintained dashboards platform in minutes instead of installing and hardening Grafana by hand. It is a straightforward, drop-in replacement for other self-managed Grafana images.

What's included beyond a stock install:

• No baked-in credentials: on first launch the image sets the Grafana 'admin' password to the EC2 instance ID (fetched via IMDSv2) and generates unique configuration secrets. Nothing secret is stored in the AMI, and every instance is unique - there is no default admin/admin login.
• TLS by default: Grafana is fronted by Caddy with a self-signed certificate on first boot; switch to automatic Let's Encrypt TLS on your own domain with one command (grafanactl set-domain).
• A one-command operator CLI (grafanactl): status, logs, on-demand and scheduled backups, guided restore, safe upgrade, custom-domain TLS, and health, all in a single tool.
• Automated nightly backups of the Grafana database (dashboards, users, data-source definitions, and settings), rotated (last 7 kept), plus on-demand backup and guided restore.
• Safe one-command upgrades of Grafana: an automatic pre-upgrade backup, then apply, with a printed rollback path.
• A hardened application baseline: Grafana runs as a non-root service under systemd with least privilege, binds to localhost behind the reverse proxy, sign-up and anonymous access are disabled, security headers are set, and the admin interface is served only over TLS.
• A hardened OS baseline (inherited from the Verified Images hardened Ubuntu 26.04 image): SSH password authentication and root login are disabled, a kernel/network sysctl hardening profile is applied, no default OS passwords or SSH keys are baked in, automatic OS security patching (unattended-upgrades) is enabled, and a health watchdog restarts the stack if Grafana stops answering.
• AWS Systems Manager (SSM) agent preinstalled for keyless, auditable instance management.
• Ongoing security maintenance: the hardened image is rebuilt and re-verified as new CVEs are disclosed, so new launches stay current.

Grafana OSS is licensed under the GNU AGPL v3, a strong copyleft OSI-approved open-source license that permits commercial use, hosting, and redistribution provided the corresponding source and any modifications are made available; it is not a source-available or resale-restricted license. This image ships Grafana unmodified, and the corresponding source is available from the upstream Grafana project (source offer honored on request). Caddy is licensed under the Apache 2.0 License and the embedded SQLite database engine is in the public domain. This product includes Grafana OSS only and does not include Grafana Enterprise. Grafana and Grafana Labs are trademarks of Raintank, Inc. dba Grafana Labs; Verified Images is an independent repackager and is not affiliated with, sponsored by, or endorsed by Grafana Labs, and this image is not Grafana Cloud or Grafana Enterprise.