Apache CouchDB 3.5.3 on AWS User Guide

Overview

This guide covers launching and using Apache CouchDB 3.5.3 on Ubuntu 24.04 from cloudimg on Amazon EC2. It is one version of the cloudimg Hardened Apache Cassandra, FerretDB & NoSQL Database AMIs listing on AWS Marketplace; you pick it as the software version when you subscribe and launch. The other databases in the listing are described on the listing's guide hub.

Apache CouchDB is an open source document database. It stores JSON documents, exposes every operation over an HTTP API, indexes documents with JavaScript map/reduce views and Mango (JSON) queries, and replicates databases between servers in both directions, which makes it a common backend for offline-first applications that sync with PouchDB. CouchDB ships its own web admin UI, Fauxton, at /_utils. This image runs CouchDB as a single node.

The cloudimg image changes how CouchDB is exposed and secured:

• No admin party, no default login. Every request, read or write, needs a valid login (require_valid_user): anonymous requests to the API, to Fauxton and to the configuration API are refused. First boot creates the admin user with a password unique to your instance; CouchDB stores it only as a PBKDF2 hash. Repeated wrong passwords from one address are locked out for five minutes.
• Secrets unique to your instance. First boot also generates the secret that signs CouchDB's login cookies, the server UUID and the Erlang distribution cookie. The image ships none of them, and no database: CouchDB creates its _users and _replicator databases on your instance's first start. CouchDB refuses to start until first boot has finished.
• HTTPS from the first boot. nginx is the only network entry point. It publishes the CouchDB API, replication and Fauxton on port 443 with a certificate generated on your instance's first boot; port 80 only redirects to HTTPS.
• CouchDB on localhost only. CouchDB listens on 127.0.0.1:5984; the Erlang distribution (port 9100 to 9200) and its port mapper epmd (4369) listen on loopback too. The Erlang cookie is kept in a file only CouchDB can read, never on a command line. Never open 5984, 4369 or 9100 to 9200 in a security group.
• No instance metadata. CouchDB (including its replicator, which fetches whatever URL a replication names), its query servers and nginx cannot reach the EC2 instance metadata service.
• Sandboxed service. CouchDB runs as its own couchdb user with no capabilities, a read-only system and write access only to its data, its log and its configuration overrides. JavaScript views run in CouchDB's bundled QuickJS engine.
• Fixed host name and real client addresses. Requests for a host name the instance does not serve are dropped; CouchDB is always handed the configured host name and the real client address (client supplied X-Forwarded-For and X-Forwarded-Host headers are overwritten), cross site browser requests that change state are refused and login cookies are SameSite=Strict.
• Your data on its own disk. Every database lives on a dedicated 20 GiB EBS volume mounted at /var/lib/couchdb, which you can resize independently of the root volume.
• Signed package. CouchDB comes from Apache's CouchDB package repository, checked against Apache's repository signing key and a pinned package checksum, and is held at 3.5.3 so a routine apt upgrade does not change your database version.
• Key only SSH. Password logins, root logins and X11 forwarding are switched off.
• Fully patched Ubuntu 24.04 LTS at build time, with unattended security upgrades switched on.

What is on the image: Apache CouchDB 3.5.3 (/opt/couchdb, Apache-2.0, with its own bundled Erlang/OTP runtime), nginx, Ubuntu 24.04 LTS, cloud-init and the AWS Systems Manager agent.

Default user: ubuntu · Architecture: x86_64 · Recommended instance type: m5.large

Prerequisites

• An AWS account subscribed to the listing, an EC2 key pair and a VPC subnet.
• A security group that allows TCP 22 (SSH) from your own networks and TCP 443 (the CouchDB API, replication and Fauxton) from the networks and applications that use CouchDB. TCP 80 only redirects to HTTPS and is optional. Do not open 5984, 4369 or 9100 to 9200.

Step 1: Launch the instance

In the AWS Marketplace listing choose Continue to Subscribe, then Continue to Configuration, pick Apache CouchDB 3.5.3 on Ubuntu 24.04 as the software version and your Region, then Launch through EC2. Choose m5.large, your key pair and a security group as above. The AMI brings its own 20 GiB data volume for CouchDB; increase its size on the launch page if you expect more data (Step 9).

With the AWS CLI (replace the values in angle brackets):

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=couchdb}]'

Step 2: Connect to your instance

ssh -i <your-key.pem> ubuntu@<public-ip>

Step 3: Check the services

First boot generates the certificate, the administrator password, the secrets and the Erlang cookie, then CouchDB and nginx start. Allow about a minute after the instance reaches the running state:

systemctl is-active couchdb nginx couchdb-firstboot
sudo test -f /var/lib/cloudimg/couchdb-firstboot.done && echo FIRSTBOOT_DONE
dpkg-query -W -f '${Package} ${Version}\n' couchdb
apt-mark showhold

active
active
active
FIRSTBOOT_DONE
couchdb 3.5.3~noble
couchdb

Only SSH and nginx listen on public addresses; CouchDB (5984), its Erlang distribution (9100) and epmd (4369) are on loopback:

sudo ss -Hlntp | awk '{print $4, $6}' | grep -v '127.0.0.5' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g' | sort

0.0.0.0:22 users:(("sshd"),("systemd"))
0.0.0.0:443 users:(("nginx"),("nginx"),("nginx"))
0.0.0.0:80 users:(("nginx"),("nginx"),("nginx"))
127.0.0.1:4369 users:(("epmd"))
127.0.0.1:5984 users:(("beam.smp"))
127.0.0.1:9100 users:(("beam.smp"))
[::1]:4369 users:(("epmd"))
[::]:22 users:(("sshd"),("systemd"))
[::]:443 users:(("nginx"),("nginx"),("nginx"))
[::]:80 users:(("nginx"),("nginx"),("nginx"))

Step 4: Get your URLs and password

The URLs and the administrator user are in the root only credentials file:

sudo grep -E '^COUCHDB_(URL|FAUXTON_URL|ADMIN_USER)=' /root/couchdb-credentials.txt

COUCHDB_URL=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/
COUCHDB_FAUXTON_URL=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/_utils/
COUCHDB_ADMIN_USER=admin

The same file holds COUCHDB_ADMIN_PASSWORD, unique to this instance. Read it with sudo grep '^COUCHDB_ADMIN_PASSWORD=' /root/couchdb-credentials.txt and keep it in your password manager. CouchDB itself keeps only a PBKDF2 hash of it.

The URLs use the instance's public DNS name from EC2 instance metadata (IMDSv2), or its public or private IPv4 address when it has no public name. The certificate names that host plus the instance's public and private IP addresses:

openssl x509 -in /etc/ssl/couchdb/couchdb.crt -noout -subject -ext subjectAltName -enddate

subject=CN = ec2-<public-ip-dashed>.compute-1.amazonaws.com, O = cloudimg
X509v3 Subject Alternative Name: 
    DNS:ec2-<public-ip-dashed>.compute-1.amazonaws.com, IP Address:<public-ip>, IP Address:<private-ip>, IP Address:127.0.0.1, DNS:localhost
notAfter=<date about 27 months after first boot>

Without a login every CouchDB request answers 401, a wrong password is refused and port 80 redirects to HTTPS. The commands below read the password from the credentials file into a shell variable and pass it to curl through a file descriptor, so it never appears in the process list or your shell history:

H=$(sudo sed -n 's#^COUCHDB_URL=https://\([^/]*\)/.*#\1#p' /root/couchdb-credentials.txt)
PW=$(sudo sed -n 's/^COUCHDB_ADMIN_PASSWORD=//p' /root/couchdb-credentials.txt)
R=(--cacert /etc/ssl/couchdb/couchdb.crt --resolve "$H:443:127.0.0.1")
curl -s -o /dev/null -w 'http://                      -> %{http_code} %{redirect_url}\n' --resolve "$H:80:127.0.0.1" "http://$H/"
curl -s -o /dev/null -w '/_all_dbs, no login          -> HTTP %{http_code}\n' "${R[@]}" "https://$H/_all_dbs"
curl -s -o /dev/null -w '/_utils/ (Fauxton), no login -> HTTP %{http_code}\n' "${R[@]}" "https://$H/_utils/"
curl -s -o /dev/null -w '/_all_dbs, wrong password    -> HTTP %{http_code}\n' "${R[@]}" -K <(printf 'user = "admin:admin"\n') "https://$H/_all_dbs"
curl -s -w '  <- /_all_dbs, your password\n' "${R[@]}" -K <(printf 'user = "admin:%s"\n' "$PW") "https://$H/_all_dbs"
curl -s "${R[@]}" -K <(printf 'user = "admin:%s"\n' "$PW") "https://$H/" | python3 -c 'import json,sys; d=json.load(sys.stdin); print(d["couchdb"], d["version"], "|", ", ".join(d["features"]))'
curl -s -w ' <- /healthz (no login)\n' "${R[@]}" "https://$H/healthz"

http://                      -> 301 https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/
/_all_dbs, no login          -> HTTP 401
/_utils/ (Fauxton), no login -> HTTP 401
/_all_dbs, wrong password    -> HTTP 401
["_replicator","_users"]
  <- /_all_dbs, your password
Welcome 3.5.3 | quickjs, access-ready, partitioned, pluggable-storage-engines, reshard, scheduler
ok
 <- /healthz (no login)

--resolve sends the request to this instance while keeping the real host name, so the certificate check passes. From another machine, drop --resolve and use the URL directly, for example curl -u admin https://<your-host>/_all_dbs (curl prompts for the password). /healthz is a static nginx endpoint for load balancer health checks; CouchDB's own /_up needs a login like every other CouchDB path.

Step 5: Store and query documents

This example creates an inventory database, adds three documents in one _bulk_docs request, runs a Mango query (red items in stock), adds a JavaScript map/reduce view that totals stock by type and queries it. The helper c sends each request with your password from a file descriptor:

H=$(sudo sed -n 's#^COUCHDB_URL=https://\([^/]*\)/.*#\1#p' /root/couchdb-credentials.txt)
PW=$(sudo sed -n 's/^COUCHDB_ADMIN_PASSWORD=//p' /root/couchdb-credentials.txt)
c() { curl -s --cacert /etc/ssl/couchdb/couchdb.crt --resolve "$H:443:127.0.0.1" -K <(printf 'user = "admin:%s"\n' "$PW") -H 'Content-Type: application/json' "$@"; echo; }
c -X PUT "https://$H/inventory"
c -X POST "https://$H/inventory/_bulk_docs" -d '{"docs":[{"_id":"widget-1","type":"widget","colour":"red","stock":12},{"_id":"widget-2","type":"widget","colour":"blue","stock":0},{"_id":"gadget-1","type":"gadget","colour":"red","stock":5}]}' | sed -E 's/"rev":"[^"]*"/"rev":"1-<rev>"/g'
c -X POST "https://$H/inventory/_find" -d '{"selector":{"colour":"red","stock":{"$gt":0}},"fields":["_id","stock"]}' | python3 -c 'import json,sys; print(json.dumps(json.load(sys.stdin)["docs"]))'
c -X PUT "https://$H/inventory/_design/stock" -d '{"views":{"by_type":{"map":"function (doc) { emit(doc.type, doc.stock); }","reduce":"_sum"}}}' | sed -E 's/"rev":"[^"]*"/"rev":"1-<rev>"/'
c "https://$H/inventory/_design/stock/_view/by_type?group=true"

{"ok":true}

[{"ok":true,"id":"widget-1","rev":"1-<rev>"},{"ok":true,"id":"widget-2","rev":"1-<rev>"},{"ok":true,"id":"gadget-1","rev":"1-<rev>"}]

[{"_id": "gadget-1", "stock": 5}, {"_id": "widget-1", "stock": 12}]
{"ok":true,"id":"_design/stock","rev":"1-<rev>"}

{"rows":[
{"key":"gadget","value":5},
{"key":"widget","value":12}
]}

For queries you run often, create a Mango index first (POST /inventory/_index with {"index":{"fields":["colour"]}}). New databases are readable and writable by server admins only (default_security = admin_only); to give an application its own login, create a user in the _users database and add it to the database's _security members, so applications never need the admin password.

Step 6: Use Fauxton

Open the COUCHDB_FAUXTON_URL from Step 4 (https://<your-host>/_utils/) in a browser. The certificate is self signed, so the browser warns once; accept it, or install your own certificate (Step 10). The browser then asks for a user and password: sign in as admin with COUCHDB_ADMIN_PASSWORD.

Fauxton opens on the Databases page, which lists the system databases _users and _replicator and the databases you created:

Choose a database to browse its documents, run Mango queries, manage its permissions and follow its changes feed:

Choose a document to edit its JSON, upload attachments or clone it:

and open a view under Design Documents to see its results:

The Replication page creates and monitors replication jobs, the Configuration page shows CouchDB's settings, and Log Out ends the session. Fauxton runs entirely in your browser and talks only to your instance.

Step 7: Replicate a database

Replication copies every document and revision from a source database to a target and can run once or continuously, in either direction, between this instance and any other CouchDB or PouchDB endpoint. Credentials for each side go in an auth object inside the request body, never in a URL or on a command line. This example makes a one-off copy of inventory on the same server; the body is built with the shell's own printf and piped to curl:

H=$(sudo sed -n 's#^COUCHDB_URL=https://\([^/]*\)/.*#\1#p' /root/couchdb-credentials.txt)
PW=$(sudo sed -n 's/^COUCHDB_ADMIN_PASSWORD=//p' /root/couchdb-credentials.txt)
c() { curl -s --cacert /etc/ssl/couchdb/couchdb.crt --resolve "$H:443:127.0.0.1" -K <(printf 'user = "admin:%s"\n' "$PW") -H 'Content-Type: application/json' "$@"; echo; }
printf '{"source":{"url":"http://127.0.0.1:5984/inventory","auth":{"basic":{"username":"admin","password":"%s"}}},"target":{"url":"http://127.0.0.1:5984/inventory-backup","auth":{"basic":{"username":"admin","password":"%s"}}},"create_target":true}' "$PW" "$PW" \
  | c -X POST "https://$H/_replicate" --data-binary @- | python3 -c 'import json,sys; d=json.load(sys.stdin); h=d["history"][0]; print("ok:", d["ok"], "| docs_written:", h["docs_written"], "| doc_write_failures:", h["doc_write_failures"])'
c "https://$H/inventory-backup" | python3 -c 'import json,sys; d=json.load(sys.stdin); print(d["db_name"], "doc_count:", d["doc_count"])'

ok: True | docs_written: 4 | doc_write_failures: 0
inventory-backup doc_count: 4

To replicate with another server, use its HTTPS URL as the source or target and that server's credentials in its auth object. For a replication that survives restarts, create a document in the _replicator database with the same fields (plus "continuous": true to keep it running), or use Fauxton's Replication page. Remote servers reach this instance at https://<your-host>/<database> with a user you created for them. The replicator can reach other hosts but never the instance metadata service (Step 8).

Step 8: The sandbox, the Erlang distribution and instance metadata

CouchDB runs as the unprivileged couchdb user. The service settings, and a probe from inside the CouchDB service: the instance metadata service is unreachable, while CouchDB itself answers on loopback (401, because every request needs a login):

systemctl show couchdb -p User -p NoNewPrivileges -p ProtectSystem -p ProtectHome -p PrivateTmp -p ReadWritePaths -p IPAddressDeny
systemctl show nginx -p IPAddressDeny
CG=$(systemctl show -p ControlGroup --value couchdb)
sudo bash -c "echo \$\$ > /sys/fs/cgroup$CG/cgroup.procs; curl -s -m 5 -o /dev/null -w 'from inside couchdb: instance metadata -> %{http_code}\n' http://169.254.169.254/latest/meta-data/; curl -s -m 5 -o /dev/null -w 'from inside couchdb: loopback CouchDB -> %{http_code}\n' http://127.0.0.1:5984/_up"

IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128
User=couchdb
ReadWritePaths=/var/lib/couchdb /var/log/couchdb /opt/couchdb/etc/local.d
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=strict
NoNewPrivileges=yes
IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128
from inside couchdb: instance metadata -> 000
from inside couchdb: loopback CouchDB -> 401

CouchDB is an Erlang application and talks to its own Erlang distribution layer, which anyone holding the Erlang cookie could use to run code inside CouchDB. On this image the distribution and epmd listen on loopback only, the cookie is generated on first boot into /opt/couchdb/.erlang.cookie (readable by couchdb only) and couchdb.service reads its VM arguments from /etc/couchdb-cloudimg/vm.args, which carries no cookie, so the cookie never appears in the process list. The instance's secrets and the administrator hash are in /opt/couchdb/etc/local.d/90-cloudimg-instance.ini (CouchDB only), where the hash is in CouchDB's PBKDF2 format:

sudo stat -c '%a %U %n' /opt/couchdb/.erlang.cookie /opt/couchdb/etc/local.d/90-cloudimg-instance.ini /root/couchdb-credentials.txt
sudo grep -c '^-setcookie' /etc/couchdb-cloudimg/vm.args
sudo grep -E '^-kernel inet_dist' /etc/couchdb-cloudimg/vm.args
ps -o args= -C beam.smp | tr ' ' '\n' | grep -c -- '-setcookie'
sudo sed -n 's/^\(admin\) = \(-pbkdf2:[a-z0-9]*\)-.*,\([0-9]*\)$/\1 = \2-<derived key>,<salt>,\3/p' /opt/couchdb/etc/local.d/90-cloudimg-instance.ini

400 couchdb /opt/couchdb/.erlang.cookie
600 couchdb /opt/couchdb/etc/local.d/90-cloudimg-instance.ini
600 root /root/couchdb-credentials.txt
0
-kernel inet_dist_use_interface {127,0,0,1}
-kernel inet_dist_listen_min 9100
-kernel inet_dist_listen_max 9200
0
admin = -pbkdf2:sha256-<derived key>,<salt>,600000

The cloudimg settings are in /opt/couchdb/etc/local.d/10-cloudimg.ini:

sudo grep -E '^(require_valid_user|bind_address|js_engine|single_node|admin_only_all_dbs) =' /opt/couchdb/etc/local.d/10-cloudimg.ini

single_node = true
js_engine = quickjs
bind_address = 127.0.0.1
require_valid_user = true
admin_only_all_dbs = true

CouchDB cannot read /etc/shadow, the TLS key, the credentials file or the nginx configuration: those paths are root only or hidden from the service. If an application needs CouchDB to reach a host the service may not reach, adjust /etc/systemd/system/couchdb.service.d/ deliberately and run sudo systemctl daemon-reload && sudo systemctl restart couchdb; keep the instance metadata deny in place.

Step 9: Storage, configuration, logs and upgrades

Every database lives under /var/lib/couchdb on the dedicated EBS volume; CouchDB's log is /var/log/couchdb/couchdb.log:

df -h /var/lib/couchdb | tail -1 | awk '{print $2" total, "$4" free on "$6}'
sudo ls /var/lib/couchdb

20G total, 19G free on /var/lib/couchdb
_dbs.couch
_nodes.couch
lost+found
shards

• Disk. To grow the volume, modify it in the EC2 console (Volumes, Modify volume) and extend the file system online: sudo resize2fs "$(findmnt -no SOURCE /var/lib/couchdb)".
• Backups. Replicate to another CouchDB (Step 7), or stop CouchDB (sudo systemctl stop couchdb) and take an EBS snapshot of the data volume. Back up /opt/couchdb/etc/local.d/90-cloudimg-instance.ini with it: it holds the administrator hash and the server UUID. First boot never runs again on an instance that has completed it.
• Configuration. Change settings in Fauxton's Configuration page or through the _node/_local/_config API (CouchDB saves them in 90-cloudimg-instance.ini), or edit 10-cloudimg.ini and run sudo systemctl restart couchdb. CouchDB's own defaults are in /opt/couchdb/etc/default.ini; do not edit that file.
• JavaScript engine. Views and validation functions run in CouchDB's bundled QuickJS engine. If a design document needs the SpiderMonkey engine instead, set js_engine = spidermonkey in 10-cloudimg.ini and restart CouchDB (SpiderMonkey 115 comes from Ubuntu's libmozjs-115-0t64, which Ubuntu does not patch, which is why the image does not use it by default).
• Upgrades. CouchDB is held at 3.5.3 (apt-mark showhold). To move to a newer CouchDB release from Apache's repository, read its release notes, take a snapshot, then run sudo apt-mark unhold couchdb && sudo apt-get update && sudo apt-get install couchdb && sudo apt-mark hold couchdb. cloudimg's settings live in local.d and /etc/couchdb-cloudimg, which the package does not overwrite.
• Logs. journalctl -u couchdb shows the service output and journalctl -u couchdb-firstboot what first boot did. nginx logs requests to /var/log/nginx/access.log without query strings.

Step 10: Use your own DNS name or certificate

The served host name is fixed by configuration, never taken from a request. To serve CouchDB under your own DNS name, point the name at the instance and run the helper, which records the name, regenerates the self signed certificate for it, updates the credentials file and reloads nginx:

sudo couchdb-set-hostname <your-dns-name>

Run the same command after a stop and start if the instance's public DNS name changed (an Elastic IP avoids that), because a request for a name the instance does not serve is dropped.

To use a certificate from your own CA or a public CA instead, replace /etc/ssl/couchdb/couchdb.crt (full chain) and /etc/ssl/couchdb/couchdb.key (mode 0600, owner root), then run sudo nginx -t && sudo systemctl reload nginx.

Step 11: Security notes

SSH accepts keys only: passwords, root logins and X11 forwarding are switched off in /etc/ssh/sshd_config.d/00-cloudimg.conf, which sorts before every other SSH setting. Check the effective values:

sudo sshd -T | grep -E '^(passwordauthentication|kbdinteractiveauthentication|permitrootlogin|x11forwarding|pubkeyauthentication) '

permitrootlogin no
pubkeyauthentication yes
passwordauthentication no
kbdinteractiveauthentication no
x11forwarding no

Other points:

• Change the administrator password with CouchDB's configuration API, sending the new password in the request body; CouchDB hashes it and saves only the hash in 90-cloudimg-instance.ini. Then update /root/couchdb-credentials.txt. For example, from a file only you can read: curl -s --cacert /etc/ssl/couchdb/couchdb.crt -u admin -X PUT https://<your-host>/_node/_local/_config/admins/admin --data-binary @new-password.json, where the file holds the new password as a JSON string.
• A server admin can change any setting and read every database. Give applications their own users in _users and database level permissions, not the admin password.
• nginx logs the real client address of every request without its query string; X-Forwarded-For headers sent by clients are ignored, and CouchDB's lockout counts failed logins per real address. The AMI requires IMDSv2. Restrict port 443 to the networks that use CouchDB.
• Bundled components. CouchDB 3.5.3 is the newest CouchDB release and fixes every CouchDB security advisory published so far. It bundles Erlang/OTP 27 (ERTS 15.2.7.13) without the Erlang SSH application. Two OTP TLS advisories published after the CouchDB release, CVE-2026-94200 (the TLS client session ticket store) and CVE-2026-105236 (TLS 1.2 session resumption across SNI host names), do not apply here: CouchDB serves no TLS itself (nginx does), and its replicator's TLS client does not enable session tickets. The optional Nouveau search server (Java libraries under /opt/couchdb/nouveau, which a scanner reports with Jackson and Jetty advisories) is switched off and cannot run, because no Java runtime is installed. cloudimg updates the image when Apache ships a newer CouchDB release.

When you have finished with the example data from Steps 5 and 7, delete it:

H=$(sudo sed -n 's#^COUCHDB_URL=https://\([^/]*\)/.*#\1#p' /root/couchdb-credentials.txt)
PW=$(sudo sed -n 's/^COUCHDB_ADMIN_PASSWORD=//p' /root/couchdb-credentials.txt)
for db in inventory inventory-backup; do curl -s -w "  <- delete $db\n" --cacert /etc/ssl/couchdb/couchdb.crt --resolve "$H:443:127.0.0.1" -K <(printf 'user = "admin:%s"\n' "$PW") -X DELETE "https://$H/$db"; done

{"ok":true}
  <- delete inventory
{"ok":true}
  <- delete inventory-backup

Support and licensing

cloudimg supports this image by email at support@cloudimg.co.uk. Include the instance ID, the version (Apache CouchDB 3.5.3 on Ubuntu 24.04) and what you were doing.

Apache CouchDB is open source software under the Apache License, version 2.0; the licence is on the instance in /opt/couchdb/LICENSE. There is no per user or per CPU licence fee. The AMI price covers cloudimg's hardening, first boot setup and support.

Apache CouchDB, CouchDB and the CouchDB logo are trademarks of The Apache Software Foundation. Erlang is a trademark of Ericsson AB. Ubuntu is a trademark of Canonical Ltd. cloudimg is not affiliated with or endorsed by these organisations.