Ortelius on Ubuntu 24.04 LTS by cloudimg

Ortelius is an open source software supply chain intelligence platform and a Continuous Delivery Foundation (CDF) project. It ingests Software Bills of Materials (SBOMs) at build time, matches every deployed component against the OSV.dev vulnerability database on a 15 minute refresh cycle, and tracks each CVE across its full lifecycle: from the moment it is introduced into a release, through detection in a running environment, to remediation. A multi-organization dashboard surfaces Mean Time To Remediate, SLA compliance by severity, 180-day vulnerability trend analysis, and alignment with NIST SP 800-53, 800-137, 800-190 and 800-218. This image is built and maintained by cloudimg on a hardened, fully patched Ubuntu 24.04 LTS base, running the Ortelius v12.0.515 Go/Fiber API and its v12.0.1632 Next.js dashboard as native systemd services, backed by ArangoDB 3.12.

The upstream default JWT signing key is never shipped: Ortelius' own source hardcodes a placeholder signing key and separately exposes a function to override it that upstream's own startup code never calls. This image is built from a small patch that wires that override up to a required per-VM environment variable, so the backend refuses to start at all without a unique signing key. Every other secret (the ArangoDB root password, the token-encryption key and the administrator password) is also generated on the first boot of every VM and written to a root-only file, and the API and dashboard do not start until that rotation completes and proves the new login works while common defaults are rejected.

The API is served over HTTP on port 3000 and the dashboard on port 8080; the browser calls the API directly, so both ports must be reachable from wherever you use the dashboard. Add your own TLS/reverse proxy for a browser-trusted HTTPS deployment. ArangoDB is bound to localhost only, so no database port is exposed. Sign in at http://your-vm:8080/ with the credentials from /root/ortelius-credentials.txt — first boot has already added the ortelius/ortelius repository as a real, populated example so you land on data, not an empty screen — then connect your own GitHub organization or favorite a public repository by name to start building your software supply chain inventory.

Ortelius is licensed under the Apache License, Version 2.0. Ortelius is a trademark of its respective owners; this image is provided by cloudimg and is not affiliated with or endorsed by the Ortelius project. Backed by 24/7 cloudimg support.