HiveMQ Community Edition on Ubuntu 24.04 LTS
by cloudimg
Production grade MQTT 3.1, 3.1.1 and 5.0 broker, authenticated and secure on first boot
HiveMQ Community Edition is an open source, production grade single node MQTT broker. It implements the full MQTT 3.1, 3.1.1 and 5.0 specifications and provides reliable publish and subscribe messaging with quality of service delivery guarantees, making it a common backbone for IoT telemetry, device command and control, and event driven communication between applications and services. This cloudimg image runs HiveMQ Community Edition 2026.5 from the official release on Ubuntu 24.04 LTS, on the OpenJDK 21 runtime, under systemd as an unprivileged service user.
The broker answers MQTT on port 1883 across all interfaces. HiveMQ Community Edition is headless: there is no web interface, since the HiveMQ Control Center is part of the commercial Enterprise edition, so you operate the broker with any standard MQTT client. The mosquitto command line clients are preinstalled so you can publish and subscribe from the VM immediately, and any MQTT 3.1.1 or 5.0 library connects with the broker address, port 1883, and the generated credential.
Security is built in. A stock HiveMQ Community Edition install ships with no authentication and accepts anonymous connections; this image closes that gap by bundling the official HiveMQ File RBAC authentication extension. On the first boot of every VM a unique administrator password is generated, stored as a salted PBKDF2 hash in the extension credentials file, and the login is written to a root only file. As a result an anonymous or wrong credential connection is refused, no two instances share a credential, and no known credential is ever baked into the image.
HiveMQ Community Edition is distributed under the Apache License 2.0, free and open source with no per CPU or per deployment fee. cloudimg is not affiliated with or endorsed by HiveMQ GmbH; HiveMQ is a mark of its owner. cloudimg provides packaging, systemd hardening, the File RBAC secure by default configuration, per instance credential automation, security patching, and 24/7 support with a guaranteed 24 hour response SLA.