Kroxylicious on Ubuntu 24.04 LTS

Kroxylicious is an open source, protocol aware proxy for Apache Kafka. It sits between your Kafka clients and your Kafka brokers and understands the Kafka wire protocol itself, so it can inspect, rewrite and police traffic as it passes. Because the policy lives in the proxy rather than in every application, you apply encryption, multi tenancy, filtering and access policy across all clients at once without changing client code. It runs on Ubuntu 24.04 LTS from a hardened, fully patched cloudimg image.

Usable on first boot

A proxy is meaningless without a broker behind it, so this image is self contained. It ships Kroxylicious 0.23.0 alongside a working single node Apache Kafka 4.3.1 broker in KRaft mode, with no ZooKeeper. You can produce and consume through the proxy the moment the VM finishes booting. When you are ready to front your own cluster you change one line of configuration.

The broker is only reachable through the proxy

The backing Kafka broker binds to loopback only, so nothing outside the VM can open a socket to it. Kroxylicious is the single network facing entry point. A proxy that can be trivially bypassed enforces nothing, so this topology is deliberate and is asserted at image build time.

What is included

• Kroxylicious 0.23.0 from the official release, SHA 512 verified, run under systemd
• Apache Kafka 4.3.1 in KRaft mode as the backing broker, bound to loopback only
• Client facing SASL SCRAM SHA 512 authentication, enforced at both the proxy and the broker
• A per VM SCRAM credential generated at first boot, in a root only file, with no default baked in
• Prometheus metrics for the proxy on a loopback management endpoint
• An on image self test that proves traffic genuinely traverses the proxy
• A fully security patched Ubuntu 24.04 LTS base at image build time
• 24/7 cloudimg support

Secure by default

Client facing authentication is on by default and enforced twice over: the backing broker requires SASL, and Kroxylicious runs the SASL inspection filter with authentication required, so the proxy refuses to forward anything but the authentication exchange until a client has authenticated. No default or bootstrap password ships in the image. The SCRAM credential is generated uniquely on each VM at first boot and written straight into Kafka cluster metadata, so there is no window in which a published default is live. Two VMs deployed from this image never share a credential.

Licensing

Kroxylicious and Apache Kafka are both Apache 2.0 licensed and free. The cloudimg charge of 0.04 US dollars per vCPU hour covers packaging, security patching, image maintenance and 24/7 expert support. Recommended size Standard_B2s. Prerequisites: an Azure subscription, a VNet and an SSH key. NSG inbound: port 22 for SSH, and ports 9192 and 9193 from the subnet your Kafka clients run in. Guide: https://www.cloudimg.co.uk/guides/kroxylicious-on-ubuntu-24-04-azure/ 24/7 support: support@cloudimg.co.uk.