Hoverfly on Ubuntu 24.04 LTS

Hoverfly is a lightweight, open source API simulation and service virtualization tool developed by SpectoLabs. It sits as a proxy in front of the HTTP and HTTPS services your application depends on, and can capture real traffic, replay it as fast deterministic virtual services, spy on requests, or modify responses on the fly. This lets teams develop and test against realistic simulations of third party or internal APIs that are slow, rate limited, costly or not yet built, and reproduce specific responses, latencies and failure modes on demand. This cloudimg image runs Hoverfly on Ubuntu 24.04 LTS as a hardened systemd service, with the OS security patched and kept current by unattended upgrades.

The image is ready the moment it boots. It ships a working demo simulation so you can see a real service virtualization round trip immediately: a request through the proxy for a virtualised endpoint returns a canned response, no real backend involved. You then replace the demo with your own simulations using the hoverctl command line tool, which captures real traffic and exports it as portable JSON you can commit to source control and replay on any Hoverfly instance.

Security is built in. Hoverfly's admin API is unauthenticated out of the box, so this image enables authentication and generates a unique admin password and JWT signing secret on each VM's first boot, written to a root only file, with nothing baked into the image. Both the admin API and the proxy are bound to loopback only. The admin API is fronted by an nginx reverse proxy on port 80 behind Hoverfly's own token authentication, and because authentication is enabled the proxy also requires credentials, so it is never an open relay. The only inbound ports are SSH and the nginx admin port.

Hoverfly is distributed under the Apache License 2.0, free and open source with no per CPU or per deployment fee. cloudimg is not affiliated with or endorsed by SpectoLabs; Hoverfly is a mark of its owner. cloudimg provides packaging, the working demo simulation, the enabled authentication with per VM credentials, the loopback only and no open relay posture, security patching, and 24/7 support with a guaranteed 24 hour response SLA.