Karapace Schema Registry on Ubuntu 24.04

Karapace is an open-source implementation of the Schema Registry and Kafka REST Proxy APIs. The schema registry gives your event streams a central, versioned contract: producers and consumers store Avro, JSON Schema and Protobuf schemas under a subject, every schema keeps its own version history, and the registry checks each proposed change against a compatibility rule, so a breaking change is caught before it reaches production rather than after a consumer has already failed on it. The REST proxy exposes the same cluster over plain HTTP, so any client that can make a web request can list topics, produce messages and consume them without a native Kafka driver.

Because Karapace implements the same APIs as the widely used Confluent equivalents, existing client libraries and tooling can point at it unchanged. It suits teams standardising the contracts between services on Kafka, anyone who needs schema governance and compatibility enforcement they host themselves, and applications in languages with no first-class Kafka client that still need to read and write events over HTTP.

Karapace is a registry and a proxy, not a store: its entire persistence layer is a compacted Kafka topic, so on its own it would start and then fail every real operation. This cloudimg image therefore bundles a broker with it, a single-node Apache Kafka 4.3.1 in KRaft mode with no ZooKeeper, already wired up as Karapace's storage, making the VM a complete, self-contained schema registry appliance that is useful the moment it boots. If you already run a Kafka cluster, the deployment guide shows how to point the registry at it instead and switch the bundled broker off.

The image is secure by default, which matters because an open schema registry lets anyone read, overwrite or delete every schema your producers and consumers depend on. Both APIs are protected by HTTP Basic authentication whose password is generated uniquely on the first boot of every VM and stored in a root-only file, and both Karapace processes and the Kafka broker are bound to the loopback interface so that authentication cannot be bypassed. Each VM formats its own empty Kafka cluster on first boot, so no two deployments share a cluster identity or any leftover data, and no compiler or build toolchain ships in the image.

Karapace and Apache Kafka are both free and open source under the Apache 2.0 licence, with no per-CPU or per-deployment fee. cloudimg is not affiliated with or endorsed by Aiven or the Karapace project. cloudimg provides packaging, the bundled and pre-configured broker, the secure-by-default posture, security patching of the base image, a paired deployment guide, and 24/7 support with a guaranteed 24-hour response SLA.