Dependency-Track on Ubuntu 24.04 LTS

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

Dependency-Track - Software Supply Chain Component Analysis by cloudimg

Deploy a private, self-hosted Dependency-Track instance on your own Azure infrastructure in minutes - no manual installation, no shared credentials. This image delivers the OWASP flagship component analysis platform fully installed and hardened, with its PostgreSQL backing store, reverse proxy and web interface already wired together, so you can upload your first SBOM as soon as the VM boots.

Why This Image Instead of Manual Installation

Installing Dependency-Track by hand means provisioning PostgreSQL, installing a Java 25 runtime, deploying the API server distribution and the frontend bundle separately, wiring a reverse proxy between them, and dealing with the well known default login. This image eliminates that operational burden:

• Dependency-Track 5.0.2 API server and frontend, both verified against the upstream release SHA256 checksums at build time
• PostgreSQL installed and wired up as the backing store, bound to loopback
• nginx serving the web interface on port 80 and reverse proxying the API, as the only public listener
• The API server and management ports kept off the public interface by a packet filter shipped in the image
• A dedicated Azure data disk holding the database and the application data directory, separate from the OS disk
• JVM heap sized automatically from the VM's actual memory on first boot
• Telemetry submission disabled by default
• Secure by default: no usable login ships in the image; a unique admin password is generated on this VM's first boot
• The stock admin / admin login is rotated and then verified rejected before the VM is handed over
• Ongoing expert support: 24/7 cloudimg engineers handle upgrades and configuration

Use Case: Know What Is In Your Software, And What Just Became Vulnerable

A team ships several applications and needs to answer two questions continuously: what components are in each release, and which of them are affected by newly published advisories. With this image they launch a VM, upload a CycloneDX SBOM for each project from their CI pipeline, and Dependency-Track maintains a live component inventory that is re-evaluated as new vulnerability data arrives - so the answer reflects today's advisories, not the day the scan was run.

Application Stack

Dependency-Track is the OWASP flagship platform for software supply chain component analysis. It ingests CycloneDX SBOMs, builds an inventory of every component in each project, and continuously evaluates that inventory against vulnerability intelligence, surfacing findings for triage and audit alongside policy violations and licence information. Version 5.x requires PostgreSQL, which this image provides locally and binds to loopback. The API server runs under a dedicated non-root service user on the OpenJDK 25 JRE; nginx serves the frontend single-page application and reverse proxies the API. All services are enabled systemd units.

Secure By Default

A stock Dependency-Track install seeds a well known admin / admin account. This image does not leave it usable. No credential is baked into the image: a one shot first boot service generates a unique administrator password on every VM's first boot, verifies that the new credential authenticates, and then explicitly asserts that the default admin / admin login is rejected before completing. The web interface on port 80 serves plain HTTP - restrict it to trusted networks and place TLS in front of it before production.

Getting Started

1. Launch the image on your chosen Azure VM size 2. Retrieve the generated admin password from the credentials file on the VM 3. Browse to the VM public IP and sign in as admin with that password 4. Upload a CycloneDX SBOM for your project and review the analysed components

Licensing and Pricing

Dependency-Track is licensed under Apache-2.0 and is free; there is no per-seat fee and no commercial tier gating core function. Both the API server and the frontend ship under that licence. The cloudimg charge of 0.04 US dollars per vCPU hour covers packaging, security patching, image maintenance, and 24/7 expert support. The web interface on port 80 is the administrative interface; restrict it to trusted networks and front it with TLS before production.

cloudimg Support

24/7 technical support by email covers deployment, upgrades, SBOM ingestion and web interface access. Critical issues receive a one-hour average response time.

Dependency-Track and OWASP are trademarks of their respective owners. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.