Stoplight Prism on Ubuntu 24.04

Stoplight Prism is a popular open source HTTP mock server and request and response validation proxy. You point it at an API description in OpenAPI, Swagger or Postman format and it stands up a live mock server in seconds: every endpoint returns realistic, schema conformant example responses, and every incoming request is validated against the contract so mismatches are caught immediately. This cloudimg image runs Prism 5.16.0 (@stoplight/prism-cli), pinned from the public npm registry, on the Node.js 24 LTS runtime it requires, on Ubuntu 24.04 LTS.

Prism lets front end, mobile and integration teams build against an API before the real backend exists, and lets teams prove that a running service actually honours its published contract. It ships with a working sample OpenAPI specification served on first boot, so you can call a live mock immediately and then replace it with your own description whenever you are ready. It can run as a mock, as a validation proxy that forwards to a real upstream and validates both request and response, or generate dynamic responses from the schema.

Application stack: Prism runs as a dedicated unprivileged system user under a hardened systemd unit, serving the mock on port 4010, with the operating system kept read only outside its own state directory. The starter specification and Prism configuration live under /opt/prism and /etc/prism, and a run wrapper selects mock or proxy mode from a simple environment file.

Security, stated honestly: Prism is by design an unauthenticated mock server, because serving a mock API to any client that can reach the port is its normal function, so there is no login, password or token to manage and nothing to rotate. The secure by default posture here is that the mock returns only synthetic example data from the specification you provide and exposes no host secret, no filesystem and no administrative surface; the only network listener is the mock itself; and no SSH key and no default operating system credential are baked into the image. For a shared or internet facing deployment, place Prism behind your own reverse proxy that terminates TLS.

Prism is distributed under the Apache License 2.0, free and open source with no per CPU or per deployment fee. cloudimg is not affiliated with or endorsed by Stoplight or the Prism project; Stoplight and Prism are marks of their owner. cloudimg provides packaging, the systemd hardening, the dedicated unprivileged service account, the starter OpenAPI specification, security patching, and 24/7 support with a guaranteed 24 hour response SLA.