Storage AWS

Alfresco Community Edition 26.2.0 on AWS User Guide

| Product: Alfresco Community Edition 26.2.0 on Ubuntu 24.04 on AWS

Overview

This guide covers launching and using the Alfresco Community Edition 26.2.0 on Ubuntu 24.04 AMI from cloudimg on Amazon EC2. It is one version of the cloudimg file sharing and sync listing on AWS Marketplace; you pick it as the software version when you subscribe and launch.

Alfresco Community Edition is an enterprise content management platform: one governed home for an organisation's documents, with folders, sites, version history, metadata, permissions and workflows. People work in the Share web interface; applications use the REST API and the CMIS standard. This AMI runs the Alfresco repository and Share on Apache Tomcat, Alfresco Search Services (Solr) for full-text search, PostgreSQL for the repository database and nginx in front, and adds the security work below.

  • No default credentials. Upstream Alfresco ships the administrator as admin / admin. On this image that account never exists: first boot writes the hash of a password generated on your instance before the repository has ever started, then proves the new password works and admin / admin is refused. The PostgreSQL password, the shared secret between the repository and Solr, and the metadata encryption keystore are also generated on your instance. The keystore password in Alfresco's own download is the same in every copy worldwide; this image does not use it.
  • HTTPS from the first boot. nginx serves Share, the REST API and CMIS on port 443 with a certificate generated on your instance's first boot. Port 80 redirects to HTTPS, and requests for a host name the instance does not serve are dropped.
  • Only nginx on the network. Tomcat (8080), Solr (8983) and PostgreSQL (5432) listen on localhost only. Tomcat has no shutdown port and no AJP connector.
  • Internal endpoints refused. nginx answers the Solr admin console (/solr), the repository's Solr tracking API (/alfresco/.../api/solr/...) and the metrics endpoint (/prometheus) with HTTP 403.
  • RSS feed dashlet off. Share's RSS dashlet fetches any address you give it from the server, without asking anyone to sign in. That would let anyone who can reach the instance make it fetch addresses inside your VPC, so nginx refuses it with HTTP 403 (Step 10 explains how to turn it back on knowingly).
  • Sign-in rate limits. Sign-in requests (Share sign-in, the ticket API) are limited to 10 a minute per address, and Basic-authenticated API calls to 600 a minute.
  • No access to the metadata service. Alfresco, Solr, PostgreSQL and nginx are blocked from the EC2 instance metadata service, and the AMI requires IMDSv2.
  • Patched libraries. 111 Java libraries bundled inside Alfresco (Spring, Netty, Jackson, Camel, Bouncy Castle, CXF, junrar, the PostgreSQL driver and others) are raised to the patched releases of the same line. The few advisories with no fix on the shipped line are listed, with why they cannot be reached, under Security notes.
  • Fully patched Ubuntu 24.04 LTS at build time, with unattended security upgrades switched on. Every download is checked against the vendor checksum and a checksum cloudimg recorded.

What is on the image: Alfresco Community Edition 26.2.0 (repository 26.2.0.96, Share 26.2.0 with the Share services module), Alfresco Search Services 2.0.23 (Solr 6.6.5), Apache Tomcat 10.1.61, OpenJDK 21, PostgreSQL 16, nginx, Ubuntu 24.04 LTS, cloud-init and the AWS Systems Manager agent.

What is not on the image: the Alfresco Transform Service and its T-Engines. Full-text search works; thumbnails and previews need the Alfresco Transform Service, which is not included. Documents are stored, versioned, permissioned, searched by their content and downloaded byte for byte. Share's built-in PDF viewer still shows PDF files (Step 6); other file types show a generic icon and a download button. ActiveMQ (events), FTP, CIFS, IMAP and inbound e-mail are not configured. This is the Community Edition: no clustering and no Alfresco support contract.

Default user: ubuntu · Architecture: x86_64 · Recommended instance type: m5.large to evaluate; m5.xlarge or larger (16 GiB) for production use

Prerequisites

  • An AWS account subscribed to the listing, an EC2 key pair and a VPC subnet with a route to the internet (or a private route you use for management).
  • A security group that allows TCP 22 (SSH), TCP 443 (Share, REST, CMIS) and TCP 80 (redirects to HTTPS) from the networks your users are on. Nothing else needs to be open.

Sizing. Alfresco runs two Java processes (the repository with Share, and Solr) plus PostgreSQL. First boot sizes both Java heaps from the instance's memory:

Instance memory Repository and Share heap Solr heap
8 GiB (m5.large) 3.5 GiB 1 GiB
16 GiB (m5.xlarge, t3.xlarge) 8 GiB 2 GiB
32 GiB or more (m5.2xlarge) 12 GiB 4 GiB

m5.large runs the whole stack and suits evaluation and small teams. For production use choose m5.xlarge or larger: the image itself is built and tested on a 16 GiB instance. The 40 GiB root volume holds the content store, the search index and the database; size it for your documents (Step 11).

Step 1: Launch the instance

In the AWS Marketplace listing choose Continue to Subscribe, then Continue to Configuration, pick Alfresco Community Edition 26.2.0 on Ubuntu 24.04 as the software version and your Region, then Launch through EC2. Choose m5.xlarge (or m5.large to evaluate), your key pair, a security group as above, and a subnet. Raise the root volume size under Configure storage if you already know you will store more than a few GiB of documents.

With the AWS CLI (replace the values in angle brackets):

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.xlarge --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=100,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=alfresco}]'

Share is served under the instance's public DNS name. For a name that never changes, attach an Elastic IP or use your own DNS name (Step 9) before you hand the address to your users.

Step 2: Connect to your instance

Version SSH user
Alfresco Community Edition 26.2.0 on Ubuntu 24.04 ubuntu 
ssh -i <your-key.pem> ubuntu@<public-ip>

Step 3: Check the services

First boot generates the secrets, creates the database and the search cores, and starts Solr and the repository. On an m5.xlarge it takes about two minutes after the instance reports running; nginx starts last, so a browser cannot reach a half-configured stack.

systemctl is-active postgresql@16-main alfresco-search alfresco nginx

active
active
active
active

Only SSH (22) and nginx (80, 443) listen on the network. Tomcat (8080), Solr (8983) and PostgreSQL (5432) are on localhost only; the two port 53 entries are Ubuntu's local DNS resolver:

sudo ss -lnt | awk 'NR>1 {print $4}' | sort -u

0.0.0.0:22
0.0.0.0:443
0.0.0.0:80
127.0.0.1:5432
127.0.0.53%lo:53
127.0.0.54:53
[::]:22
[::]:443
[::]:80
[::ffff:127.0.0.1]:8080
[::ffff:127.0.0.1]:8983

nginx refuses the internal endpoints and the RSS dashlet:

H=$(cat /etc/cloudimg/alfresco-hostname)
for p in /solr/ /alfresco/service/api/solr/aclchangesets /alfresco/s/prometheus \
         /share/service/components/dashlets/async-rssfeed; do
  printf '%-50s HTTP %s\n' "$p" "$(curl -s -o /dev/null -w '%{http_code}' \
    --cacert /etc/nginx/ssl/alfresco.crt --resolve "$H:443:127.0.0.1" "https://$H$p")"
done

/solr/                                             HTTP 403
/alfresco/service/api/solr/aclchangesets           HTTP 403
/alfresco/s/prometheus                             HTTP 403
/share/service/components/dashlets/async-rssfeed   HTTP 403

If nginx is not active, first boot has not finished (or failed, in which case Alfresco stays closed). Check systemctl status alfresco-firstboot and journalctl -u alfresco-firstboot.

Step 4: Your administrator password

First boot writes the address, the administrator name and password, and the certificate fingerprint to /root/alfresco-credentials.txt, readable by root only:

sudo stat -c '%a %U:%G %n' /root/alfresco-credentials.txt
sudo grep -E '^(Share UI|Administrator|ALFRESCO_URL|ALFRESCO_API_URL|ALFRESCO_ADMIN_USER)' /root/alfresco-credentials.txt

600 root:root /root/alfresco-credentials.txt
Share UI          : https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/share/
Administrator     : admin
ALFRESCO_URL=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/share/
ALFRESCO_API_URL=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/alfresco/api/-default-/public/
ALFRESCO_ADMIN_USER=admin

The password itself is on the Password line (and repeated as ALFRESCO_ADMIN_PASSWORD= for scripts). It is unique to your instance and is not printed anywhere else, not even in the system log. Show it when you need it:

sudo grep '^ALFRESCO_ADMIN_PASSWORD=' /root/alfresco-credentials.txt | cut -d= -f2-

The upstream admin / admin account was never created. Both a request with it and a request with no credentials are refused:

H=$(cat /etc/cloudimg/alfresco-hostname)
API="https://$H/alfresco/api/-default-/public/alfresco/versions/1"
curl -s -o /dev/null -w 'admin/admin     -> HTTP %{http_code}\n' -u admin:admin \
  --cacert /etc/nginx/ssl/alfresco.crt --resolve "$H:443:127.0.0.1" "$API/people/-me-"
curl -s -o /dev/null -w 'no credentials  -> HTTP %{http_code}\n' \
  --cacert /etc/nginx/ssl/alfresco.crt --resolve "$H:443:127.0.0.1" "$API/people/-me-"

admin/admin     -> HTTP 401
no credentials  -> HTTP 401

The built-in self test signs in with your password over HTTPS, uploads a document, finds it by a word that appears only inside it, downloads it, compares the checksum and deletes it again:

sudo alfresco-roundtrip.sh

ROUNDTRIP_PASS node=c5473c63-a9eb-4f2b-873c-63a9ebaf2be4 sha256=f549f80994d54a4dfc6d52464776f06f1a892062d3ee0036823afc5213b24a98

Step 5: Sign in to Share

Share is at https://<your-host>/share/, the Share UI address above (the bare https://<your-host>/ redirects there). Use that host name rather than the IP address: Share checks that sign-in comes from the configured name. The certificate is self signed, so your browser asks you to confirm it the first time. Before you accept it, compare the SHA-256 fingerprint your browser shows with the one on the instance (or install your own certificate, Step 9):

openssl x509 -in /etc/nginx/ssl/alfresco.crt -noout -subject -fingerprint -sha256

subject=CN = ec2-<public-ip-dashed>.compute-1.amazonaws.com, O = cloudimg
sha256 Fingerprint=<certificate fingerprint>

Sign in as admin with the password from Step 4:

The Alfresco Share sign-in page served by the cloudimg instance

The dashboard collects your sites, the activity in them, your tasks and the documents you worked on recently. The Sample: Web Site Design Project site is Alfresco's own example content; delete it from Sites when you no longer need it.

The Administrator dashboard in Share with a Sales site and two documents

To sign out, open the Administrator menu at the top right and choose Logout. In Share 26.2 signing out is a POST request made by that menu; a plain link to the sign-out address is answered with HTTP 405 and leaves you signed in.

Step 6: Sites, documents, search and the PDF viewer

Sites in the toolbar creates a collaboration site (here: Sales). Each site has a document library where you upload, organise, version and share files:

The document library of the Sales site listing a PDF and a text document

The search box at the top right searches the content of documents, not only their names. Here the word searched for appears only inside the text of quarterly-report.txt, and the result shows the matching sentence with the word highlighted. The facets on the left narrow results by creator, file type, date and size:

Share search results for a word that appears only inside a document, with the match highlighted

Opening a document shows its details, version and actions (edit properties, upload a new version, permissions, workflows, move, copy, delete). For PDF files, Share's built-in viewer (pdf.js 5.4.54) draws the pages in your browser:

The document details page showing a PDF drawn by Share's built-in viewer

Full-text search works; thumbnails and previews need the Alfresco Transform Service, which is not included. So Office documents, images and other formats show a generic icon and a Download button instead of a preview, and the document library shows no thumbnails. The viewer runs no JavaScript embedded in a PDF: Share wires no scripting into it and the image ships none of pdf.js's scripting files, so a PDF that tries to open a dialog or run code when opened does nothing (cloudimg checks this in Chrome on every build).

Step 7: Use the REST API and CMIS

Applications reach the repository at https://<your-host>/alfresco/api/-default-/public/ (the ALFRESCO_API_URL line). The commands below run on the instance. They keep the password out of the command line and out of your shell history by writing it to a curl configuration file in memory, readable only by you, and pin the instance's certificate with --cacert. They upload a document, find it by a word that appears only inside it, download it, compare the checksums and delete it:

H=$(cat /etc/cloudimg/alfresco-hostname)
CFG=$(mktemp -p /dev/shm alfresco-curl.XXXXXX)
sudo awk -F= '$1=="ALFRESCO_ADMIN_PASSWORD" {print "user = \"admin:" substr($0, index($0, "=") + 1) "\""}' \
  /root/alfresco-credentials.txt > "$CFG"
alf() { curl -s --cacert /etc/nginx/ssl/alfresco.crt --resolve "$H:443:127.0.0.1" -K "$CFG" "$@"; }
API="https://$H/alfresco/api/-default-/public/alfresco/versions/1"
SEARCH="https://$H/alfresco/api/-default-/public/search/versions/1/search"

WORD="budget$(od -An -N4 -tx1 /dev/urandom | tr -d ' \n')"
printf 'Quarterly report\n\nThe %s division grew its revenue in Q3.\n' "$WORD" > /tmp/report.txt
NODE=$(alf -X POST "$API/nodes/-shared-/children" -F filedata=@/tmp/report.txt \
  -F name=report.txt -F nodeType=cm:content -F autoRename=true \
  | python3 -c 'import sys, json; print(json.load(sys.stdin)["entry"]["id"])')
echo "uploaded to Shared: $NODE"

HITS=0
for i in $(seq 1 36); do
  HITS=$(alf -X POST "$SEARCH" -H 'Content-Type: application/json' \
    -d "{\"query\":{\"language\":\"afts\",\"query\":\"TEXT:$WORD\"}}" \
    | python3 -c 'import sys, json; print(json.load(sys.stdin)["list"]["pagination"]["count"])') || HITS=0
  [ "${HITS:-0}" -gt 0 ] && { echo "found by full-text search after about $((i * 5)) s"; break; }
  sleep 5
done

alf "$API/nodes/$NODE/content" -o /tmp/report-downloaded.txt
A=$(sha256sum < /tmp/report.txt); B=$(sha256sum < /tmp/report-downloaded.txt)
[ "$A" = "$B" ] && echo "downloaded copy is byte identical"
alf -o /dev/null -w 'deleted (not kept in the trashcan): HTTP %{http_code}\n' -X DELETE "$API/nodes/$NODE?permanent=true"
rm -f "$CFG" /tmp/report.txt /tmp/report-downloaded.txt
[ "${HITS:-0}" -gt 0 ] && [ "$A" = "$B" ]

uploaded to Shared: bfb03720-f4ac-4592-b037-20f4acb5924f
found by full-text search after about 40 s
downloaded copy is byte identical
deleted (not kept in the trashcan): HTTP 204

Search is eventually consistent: Solr picks up new documents on a polling cycle and text extraction adds a step, so a new document is usually searchable within a minute (longer just after a restart).

CMIS 1.1 is served at https://<your-host>/alfresco/api/-default-/public/cmis/versions/1.1/browser (browser binding) and .../versions/1.1/atom (AtomPub). Point a CMIS client such as Apache Chemistry Workbench, or a CMIS library, at either address with an Alfresco user name and password. From the instance:

H=$(cat /etc/cloudimg/alfresco-hostname)
CFG=$(mktemp -p /dev/shm alfresco-curl.XXXXXX)
sudo awk -F= '$1=="ALFRESCO_ADMIN_PASSWORD" {print "user = \"admin:" substr($0, index($0, "=") + 1) "\""}' \
  /root/alfresco-credentials.txt > "$CFG"
curl -s --cacert /etc/nginx/ssl/alfresco.crt --resolve "$H:443:127.0.0.1" -K "$CFG" \
  "https://$H/alfresco/api/-default-/public/cmis/versions/1.1/browser" \
  | python3 -c 'import sys, json; r = json.load(sys.stdin)["-default-"]; print(r["productName"], r["productVersion"], "| CMIS", r["cmisVersionSupported"], "| root folder", r["rootFolderUrl"].split("/public/")[1])'
rm -f "$CFG"

Alfresco Community 26.2.0 (rec48a987-b1817) | CMIS 1.1 | root folder cmis/versions/1.1/browser/root

From another machine, use your own Alfresco user (Step 8) rather than the administrator, and HTTPS to the instance's name.

Step 8: Change the administrator password and add users

Change the administrator password in Share: Administrator menu, My Profile, then Change Password. Enter the password from Step 4 as the old password:

Share's Change Password page

The credentials file still holds the first-boot password afterwards, and the built-in self test (alfresco-roundtrip.sh) reads it from there. Once you have stored the new password in your own password manager, remove the old one from the file:

sudo sed -i -e '/^Password /d' -e '/^ALFRESCO_ADMIN_PASSWORD=/d' /root/alfresco-credentials.txt

Create a named account for each person under Admin Tools, Users, and grant access per site (site members and roles) or per folder (Manage Permissions) rather than sharing the administrator account. Admin Tools also manages groups, categories, tags and the search facets.

Step 9: Use your own host name and certificate

Point a DNS record at the instance (an Elastic IP keeps the address across stop and start), then tell Alfresco its name. This mints a new self-signed certificate for that name, pins nginx to it, updates the host names Alfresco and Share use for links and for their cross-site checks, updates the address lines of the credentials file, and restarts Alfresco (about two minutes):

sudo alfresco-set-hostname alfresco.example.com

It prints the new certificate's fingerprint. The TLS certificate line of the credentials file keeps the first-boot fingerprint, so after a change always read the fingerprint from the certificate itself with the openssl x509 command in Step 5. The name is kept across reboots and stop and start. Without your own name, the instance keeps serving the public DNS name it had at first boot: if a stop and start gives it a new public address (no Elastic IP), run sudo alfresco-set-hostname <new-public-dns-name> so that Share accepts sign-in on the new name.

To use a certificate from a public authority instead, set the name first, then replace /etc/nginx/ssl/alfresco.crt (the full chain) and /etc/nginx/ssl/alfresco.key (mode 0600, owned by root) and reload nginx:

sudo install -m 0644 -o root -g root fullchain.pem /etc/nginx/ssl/alfresco.crt
sudo install -m 0600 -o root -g root privkey.pem /etc/nginx/ssl/alfresco.key
sudo nginx -t && sudo systemctl reload nginx

The commands in this guide (and alfresco-roundtrip.sh) pin the self-signed certificate with --cacert; with a certificate from a public authority, drop that option. Running alfresco-set-hostname again later replaces your certificate with a new self-signed pair.

Step 10: What the image changes from upstream's defaults

  • The RSS feed dashlet is disabled. nginx answers every address containing rssfeed with HTTP 403, because Share's feed web script fetches any feed-url from the server without authentication: anyone who could reach Share could make the instance fetch addresses inside your network. Alfresco's metadata-service block still applies, but other addresses in your VPC would be reachable. If you need the dashlet and accept that, restrict the security group to trusted networks first, then delete the line if ($uri ~* "rssfeed") { return 403; } from /etc/nginx/sites-available/cloudimg-alfresco and run sudo nginx -t && sudo systemctl reload nginx.
  • Search and metrics endpoints. /solr, the repository's api/solr tracking API and /prometheus are refused with 403 by nginx. Solr itself listens on localhost only and authenticates the repository with the per-instance shared secret.
  • Previews and thumbnails are off because the Transform Service is not included (Step 6). Text is extracted for full-text search inside the repository itself.
  • ActiveMQ, FTP, CIFS, NFS, IMAP, inbound e-mail, guest sign-in and the metrics endpoint are off. Outbound e-mail is not configured; to send notifications, set mail.host, mail.port, mail.username, mail.password and mail.from.default in /opt/alfresco/tomcat/shared/classes/alfresco-global.properties and restart alfresco.
  • Host name. Alfresco's own links and Share's cross-site checks use the configured name (Step 9), never the Host header a client sends.

Step 11: Services, logs, storage and backups

Every service is enabled and starts in order after a reboot or a stop and start:

systemctl is-enabled postgresql alfresco-search alfresco nginx unattended-upgrades

enabled
enabled
enabled
enabled
enabled

Restart the repository and Share with sudo systemctl restart alfresco (about a minute before Share answers again), and Solr with sudo systemctl restart alfresco-search. The readiness probe answers 200 when the repository is up:

curl -s -o /dev/null -w 'repository ready probe: HTTP %{http_code}\n' \
  http://127.0.0.1:8080/alfresco/api/-default-/public/alfresco/versions/1/probes/-ready-

repository ready probe: HTTP 200

When Tomcat stops Share it logs a block of SEVERE ... checkThreadLocalMapForLeaks lines; they are normal for Share on Tomcat and do not mean the restart failed.

What Where
Content store (the files) /var/lib/alfresco/alf_data
Repository database PostgreSQL 16 database alfresco, cluster 16/main, /var/lib/postgresql/16/main
Metadata encryption keystore /etc/alfresco/keystore
Search index /var/lib/alfresco/solr-data (Solr home /var/lib/alfresco/solrhome)
Repository configuration /opt/alfresco/tomcat/shared/classes/alfresco-global.properties
Java heap sizes /etc/alfresco/alfresco.env, /etc/alfresco/alfresco-search.env
Logs /var/log/alfresco/tomcat/alfresco.log, share.log, catalina.*.log; /var/log/alfresco/solr; journalctl -u alfresco
nginx site /etc/nginx/sites-available/cloudimg-alfresco
Build information /usr/share/doc/alfresco-community-edition/ (versions, checksums, licences)

Backups. The database and the content store are a matched pair: a backup of one without the other does not restore. Back up the keystore with them, because encrypted properties in the database cannot be read without it. The search index can be rebuilt from the repository, so it is optional. The simplest complete backup is an EBS snapshot (or AWS Backup) of the root volume taken with Alfresco stopped:

sudo systemctl stop alfresco alfresco-search
# take the EBS snapshot or AWS Backup job here
sudo systemctl start alfresco-search alfresco

For a file-level backup, stop Alfresco, dump the database and archive the content store and keystore together, then start it again:

sudo install -d -m 0700 /var/backups/alfresco
sudo systemctl stop alfresco alfresco-search
sudo -u postgres pg_dump -Fc alfresco | sudo tee /var/backups/alfresco/db.dump > /dev/null
sudo tar -C / -czf /var/backups/alfresco/files.tar.gz var/lib/alfresco/alf_data etc/alfresco \
  opt/alfresco/tomcat/shared/classes/alfresco-global.properties
sudo systemctl start alfresco-search alfresco

To restore onto a fresh instance of this AMI, stop Alfresco, restore the database with sudo -u postgres pg_restore --clean --if-exists -d alfresco db.dump, extract the archive over /, and start Alfresco again; the search index rebuilds itself from the repository.

Copy both files off the instance (for example to Amazon S3); they contain your documents and the instance's secrets, so keep them private. To grow the storage, increase the root volume in the EC2 console (or aws ec2 modify-volume); Ubuntu grows the file system on the next boot, or straight away with sudo growpart /dev/nvme0n1 1 && sudo resize2fs /dev/nvme0n1p1.

Security notes

  • Secrets. The administrator password, the PostgreSQL password, the repository-to-Solr shared secret, the metadata keystore and the TLS key are created on your instance's first boot; none is baked into the image and none is passed on a command line. The credentials file is root only; the other secrets are in /etc/alfresco (root and the alfresco service only).
  • Network. Restrict 22/tcp to your management network and 80/443 to your users' networks. Port 80 only redirects to HTTPS (and answers /healthz for load balancer checks). nginx logs requests without their query strings.
  • Metadata service. Alfresco, Solr, PostgreSQL and nginx are denied the EC2 instance metadata address; first boot reads the instance's name through IMDSv2 in a separate short-lived unit.
  • Tomcat. The web applications are owned by root, so the alfresco service user cannot change its own code; error pages carry no stack traces or version; the session cookie is Secure and SameSite=Lax; Tomcat trusts the client address only from nginx on localhost.
  • Reviewed residual advisories. These have no fixed release on the line Alfresco 26.2.0 ships, and none can be reached on this image (each is checked at build): CVE-2026-84939 in FreeMarker (Share and the repository; template lookups that would use it are switched off), CVE-2026-107725 and CVE-2026-107726 in Hazelcast inside Share (clustering is not configured and nothing listens for it), CVE-2026-75140 in jsoup (only used by text extraction's HTML parser, never its XML tree parser), CVE-2026-54399 and CVE-2026-54428 in httpcore5 (HTTP client to localhost services only), CVE-2026-102554 in Guava and CVE-2021-22569 / CVE-2024-7254 in protobuf 2.5.0 inside the JavaScript compiler (no reachable input), and CVE-2026-2332 / CVE-2026-10050 in the Jetty inside Search Services (localhost only, never proxied). cloudimg rebuilds this version when fixes ship. Unattended upgrades keep Ubuntu's packages (OpenJDK, PostgreSQL, nginx) patched.

Licences

Alfresco Community Edition and Alfresco Search Services are licensed under the GNU LGPL v3 or later (LGPL-3.0-or-later). Apache Tomcat, Solr, Spring, Netty, Jackson, Camel, CXF and pdf.js are Apache-2.0; Bouncy Castle is MIT; PostgreSQL and its JDBC driver are under the PostgreSQL and BSD-2-Clause licences; OpenJDK is GPL-2.0 with the Classpath exception. One bundled component is not open source: junrar 7.6.1, which Alfresco uses to read RAR archives for text extraction, is under the UnRAR licence (freely redistributable, not OSI-approved). This image is therefore not wholly open source. The licence texts are in /usr/share/doc/alfresco-community-edition/ on the instance.

Architecture summary

Component Detail
Repository and Share Alfresco Community Edition 26.2.0 (repository 26.2.0.96, Share 26.2.0) on Apache Tomcat 10.1.61 with OpenJDK 21, alfresco.service, 127.0.0.1:8080
Search Alfresco Search Services 2.0.23 (Solr 6.6.5), alfresco-search.service, 127.0.0.1:8983, cores alfresco and archive
Database PostgreSQL 16, postgresql@16-main.service, 127.0.0.1:5432
Web server nginx on 443 (HTTPS, per instance certificate in /etc/nginx/ssl), 80 redirects to HTTPS, /healthz for load balancer checks
Addresses Share https://<host>/share/, REST https://<host>/alfresco/api/-default-/public/, CMIS https://<host>/alfresco/api/-default-/public/cmis/versions/1.1/
Not included Transform Service and T-Engines (thumbnails, previews), ActiveMQ
Credentials /root/alfresco-credentials.txt, mode 0600, root only
Helpers alfresco-set-hostname, alfresco-roundtrip.sh (in /usr/local/sbin)
First boot alfresco-firstboot.service (sentinel /var/lib/cloudimg/alfresco-firstboot.done)
Ports 22 SSH, 80 redirect, 443 Share, REST and CMIS
Base image Ubuntu 24.04 LTS, fully patched, unattended security upgrades enabled, IMDSv2 required

Support

cloudimg provides 24/7 support for this image, the Ubuntu operating system and its deployment. Email support@cloudimg.co.uk with your AWS account ID and the instance ID. For Alfresco itself, see the Alfresco Content Services Community documentation and the Alfresco community forum. Alfresco is a trademark of Hyland Software, Inc.; cloudimg is not affiliated with or endorsed by Hyland.