draw.io on Ubuntu 24.04 LTS

draw.io, also known as diagrams.net, is a full featured, open source diagram editor that runs entirely in the browser. It handles flowcharts, UML and entity relationship diagrams, network and cloud architecture diagrams, BPMN, org charts, mind maps and more, on an infinite canvas with a large built in shape library. Because the editor is client side, your diagrams live in your browser and on your own device rather than on the server, which makes self hosting a natural fit for teams that want a private, in house alternative to a cloud diagramming service.

This cloudimg image deploys the official draw.io v30.3.14 release (draw.war) on Apache Tomcat 9.0.120 running on OpenJDK 17, which is the same runtime draw.io's own official container uses. Every downloaded artifact is pinned by exact version and verified against a checksum at build time. nginx terminates HTTPS on port 443 with a certificate that is generated uniquely per virtual machine on first boot, and reverse proxies to Tomcat, which is bound to the loopback interface only. Port 80 redirects to HTTPS and an unauthenticated health endpoint is provided for load balancer probes.

The servlet container is hardened before the image is captured: the Tomcat manager and host manager web applications are removed, the users file is shipped empty and the shutdown port is disabled, so there is no admin console and no default credential. Note that draw.io itself has no login, and its built in image proxy can fetch remote URLs on the server's behalf, so restrict inbound access with your network security group or an authenticating proxy before exposing it beyond a trusted network; the paired deployment guide shows how. The image ships with the latest security patches applied at build time and stays current through unattended upgrades.

draw.io is free and open source under the Apache License 2.0. cloudimg provides 24/7 commercial support with a guaranteed 24 hour response SLA, separate from the upstream project, and the cloudimg charge covers packaging, security patching, image maintenance and support.