THREDDS Data Server 5.9 on Ubuntu 24.04 LTS

The THREDDS Data Server is the reference server from NSF Unidata for publishing scientific data. You point it at a directory of netCDF, HDF, GRIB or NEXRAD files and it exposes every one of them through the remote access protocols the earth science community already uses: OPeNDAP and DAP4 for programmatic subsetting from Python, R, MATLAB, Panoply or the netCDF C library, OGC WMS for map layers a GIS client can consume, OGC WCS for coverage retrieval, the NetCDF Subset Service for pulling a bounding box or a time range straight out of a large grid, and plain HTTP for whole file download. Tying it together is the THREDDS catalog, an XML description of your holdings that clients crawl to discover what is available and how to reach it.

What you get

• THREDDS Data Server 5.9 at a pinned, checksum verified upstream release
• Apache Tomcat 10.1 and OpenJDK 17 from the Ubuntu archive, so the whole stack keeps receiving security updates
• Every remote access service enabled: OPeNDAP, DAP4, OGC WMS, OGC WCS, the NetCDF Subset Service, CdmRemote and HTTP file download
• Nine sample datasets serving from first boot, so the catalogue is live before you add anything
• Godiva3, the built in map viewer, opening on real data rather than an empty layer tree
• A unique administrator password and TLS certificate generated on the first boot of every instance
• A paired step by step deployment guide and 24/7 cloudimg support

It works the moment it boots, with nothing else to reach

A stock server presents an empty catalogue until you configure one. This image ships a working catalogue of nine small netCDF files that come from the server's own distribution: a global ocean wind and wave forecast grid, four NCEP Eta model runs on the AWIPS 211 grid, a polar stereographic grid that deliberately crosses the date line, and two station time series in the CF discrete sampling geometry convention. Nothing in that catalogue points at a third party server, so the instance serves real data over every protocol with no outbound internet access at all. The version phone home is switched off for the same reason.

The map rendering defaults are corrected too. Upstream applies one colour scale range to every variable in every dataset, which is wrong for almost any real quantity, so a plain map request from a GIS client returns a valid image that is entirely one flat colour. Each shipped variable is given a colour scale matched to its physical range, so the default request returns a readable map.

Public data, private controls

A data server exists to publish, so the catalogue and every data endpoint are reachable by design. The management surface is treated as the opposite. The administrative pages are refused outright over plain HTTP, never redirected, so an administrator password can never cross the network in the clear, and over HTTPS they are guarded by an account whose password is generated on your instance and exists nowhere else, stored only as a salted, heavily iterated hash. The captured image contains no account at all: the servlet container ships with no users and no roles, and no private key. Tomcat listens only on the loopback interface behind a reverse proxy that forwards an explicit allowlist and answers everything else with a not found, and the container management applications are absent from the image entirely. Remote catalogue fetching and remote map and coverage services are disabled, so the server will not fetch a URL a caller hands it.

Licensing

The THREDDS Data Server is open source software released by the University Corporation for Atmospheric Research under the BSD 3-Clause licence. There is no licence fee, no field of use restriction and no per user cost. The cloudimg charge of $0.04 per vCPU per hour covers packaging, security patching, image maintenance and 24/7 support. cloudimg is not affiliated with, endorsed by, or sponsored by NSF Unidata or UCAR. All trademarks are the property of their respective owners.