Storage AWS

Plakar 1.1.8 on AWS User Guide

Last updated: 2026-11-07 | Product: Plakar 1.1.8 on Ubuntu 24.04 on AWS

Overview

This guide covers launching and using the Plakar 1.1.8 on Ubuntu 24.04 AMI from cloudimg on Amazon EC2. It is one version of the cloudimg backup and recovery listing on AWS Marketplace; you pick it as the software version when you subscribe and launch.

Plakar is an open source backup tool. It splits data into content defined chunks, deduplicates and compresses them, and encrypts everything (AES-256-GCM-SIV) with a key derived from the repository passphrase before it is written, so the repository (Plakar calls it a Kloset store) only ever holds ciphertext. Every backup is a browsable, restorable snapshot, and the Plakar web UI shows them.

Upstream, plakar ui serves its pages to anyone who can reach its port and only its API checks a token, and the repository server protocol has no authentication at all. The cloudimg image makes it a backup server you can put in a VPC:

TLS and a token from the first boot. nginx serves the web UI on port 443 (https://<host>/) with a certificate generated on your instance's first boot for its DNS name and IP addresses. Every request except the health check needs the web UI token, a random value generated on first boot: without it nginx answers 401, so not even the UI's pages are served to an anonymous visitor. Plakar itself listens on 127.0.0.1 only, and nothing listens on port 80.
An encrypted repository ready to use. First boot creates an encrypted repository on a separate 32 GiB gp3 data volume mounted at /var/lib/plakar, which you can resize on its own, with a repository passphrase unique to the instance. The token and the passphrase are written to /root/plakar-credentials.txt (root only); neither is ever passed on a command line or written to a log.
The command line ready for root. sudo plakar backup /etc, sudo plakar ls and sudo plakar restore work at once against the same repository the UI shows. The repository is served on 127.0.0.1:9876 by a separate service, and a loopback firewall lets only root and the Plakar service account connect to it; only root and nginx can reach the UI port.
An egress firewall for Plakar. The web UI can install integrations and be pointed at storage by URL, so an unprotected server can be made to connect to addresses inside your network. On this image every connection that the Plakar services open to link local, metadata, carrier grade NAT or private (RFC 1918) addresses is refused by the kernel, with a second, independent block in the services' own cgroups. Public endpoints stay reachable, and plakar-egress-allow opens a single private host when you need one. The rules load before Plakar on every boot, and Plakar refuses to start without them.
Locked down. Plakar runs as an unprivileged user in sandboxed services; Plakar, nginx and the first boot service cannot reach the instance metadata service, and the AMI requires IMDSv2. Cross site browser requests are refused, requests for host names the instance does not serve are dropped, and the root helpers refuse symbolic links planted under the data directory.
Built from source. Plakar 1.1.8 is compiled from the upstream release (pinned by SHA-256) with the pinned Go 1.27.3 toolchain, with its dependencies raised to versions that fix the published advisories in the upstream set, on fully patched Ubuntu 24.04 LTS with unattended security upgrades switched on.

What is on the image: Plakar 1.1.8 (/opt/plakar, licence and build provenance in /usr/share/doc/plakar), nginx, Ubuntu 24.04 LTS, cloud-init and the AWS Systems Manager agent.

Default user: ubuntu · Architecture: x86_64 · Recommended instance type: m5.large

Prerequisites

An AWS account subscribed to the listing, an EC2 key pair and a VPC subnet.
A security group that allows TCP 22 (SSH) and TCP 443 (the web UI) from your own networks only. Nothing else needs to be open.

Step 1: Launch the instance

In the AWS Marketplace listing choose Continue to Subscribe, then Continue to Configuration, pick Plakar 1.1.8 on Ubuntu 24.04 as the software version and your Region, then Launch through EC2. Choose m5.large, your key pair, and a security group as above. The AMI attaches the 32 GiB data volume for /var/lib/plakar automatically; increase its size in the launch wizard's storage section to fit the data you will back up (deduplication and compression usually make a repository much smaller than the data in it).

With the AWS CLI (replace the values in angle brackets):

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=plakar}]'

Step 2: Connect to your instance

Version	SSH user
Plakar 1.1.8 on Ubuntu 24.04	`ubuntu`

ssh -i <your-key.pem> ubuntu@<public-ip>

Step 3: Check the services

First boot generates the certificate, the token, the passphrase and the repository; the egress firewall, the repository service, the web UI and nginx then start:

systemctl is-active plakar-store plakar-ui nginx cloudimg-plakar-egress
sudo test -f /var/lib/cloudimg/plakar-firstboot.done && echo FIRSTBOOT_DONE

active
active
active
active
FIRSTBOOT_DONE

Only SSH and nginx listen on the network. The repository service (9876) and the web UI (9877) are on loopback behind nginx, and the DNS resolver listens on loopback only:

sudo ss -lntp | awk 'NR>1 {print $4, $6}' | sed -E 's/pid=[0-9]+,fd=[0-9]+/.../g' | sort

0.0.0.0:22 users:(("sshd",...),("systemd",...))
0.0.0.0:443 users:(("nginx",...),("nginx",...),("nginx",...),("nginx",...),("nginx",...))
127.0.0.1:9876 users:(("plakar",...))
127.0.0.1:9877 users:(("plakar",...))
127.0.0.53%lo:53 users:(("systemd-resolve",...))
127.0.0.54:53 users:(("systemd-resolve",...))
[::]:22 users:(("sshd",...),("systemd",...))
[::]:443 users:(("nginx",...),("nginx",...),("nginx",...),("nginx",...),("nginx",...))

The repository is on its own volume:

df -h /var/lib/plakar | awk 'NR==2 {print $2, $6}'

32G /var/lib/plakar

Step 4: Get your URL, token and passphrase

The credentials file is readable by root only. This prints it with the token and the passphrase hidden; sudo cat /root/plakar-credentials.txt shows them:

sudo sed -E 's/^(PLAKAR_(UI_TOKEN|REPOSITORY_PASSPHRASE)=).*/\1<hidden>/; s/(plakar_token=)[0-9a-f]+/\1<hidden>/' /root/plakar-credentials.txt

# Plakar 1.1.8 - generated on first boot by plakar-firstboot.service
# Every value below is unique to this instance; none was baked into the image. Keep this file secret.
# PLAKAR_REPOSITORY_PASSPHRASE encrypts every backup in the repository: store a copy somewhere safe. Without it the
# repository cannot be opened, by you or by anyone else.

PLAKAR_URL=https://ec2-18-233-158-68.compute-1.amazonaws.com/?plakar_token=<hidden>
PLAKAR_HOST=ec2-18-233-158-68.compute-1.amazonaws.com
PLAKAR_UI_TOKEN=<hidden>
PLAKAR_REPOSITORY=/var/lib/plakar/repo
PLAKAR_STORE=@cloudimg (http://127.0.0.1:9876, root only)
PLAKAR_REPOSITORY_PASSPHRASE=<hidden>
PLAKAR_KEYFILE=/etc/plakar/repo.key
PLAKAR_CA_CERT=/etc/plakar/tls/plakar.crt
PLAKAR_CERT_SHA256=<sha256 fingerprint of your certificate>
#
# Web UI: open PLAKAR_URL once (it sets a cookie); the certificate is self-signed, see the guide.
# Back up from the command line: sudo plakar backup /etc      List: sudo plakar ls      Restore: sudo plakar restore -to /tmp/r <id>
# New web UI token (lockout recovery): sudo plakar-rotate-token
# Change the name it serves as: sudo plakar-set-hostname <your-dns-name>
# Allow a private storage host for the web UI: sudo plakar-egress-allow add <cidr>
# User guide: https://www.cloudimg.co.uk/guides/plakar-1-1-8-on-ubuntu-24-04-aws/

Your instance shows its own DNS name and certificate fingerprint. What each value is for:

Value	Used for
`PLAKAR_URL`	The web UI link with the token in it. Open it once in your browser (Step 5)
`PLAKAR_UI_TOKEN`	The web UI token, for the browser link and as an `Authorization: Bearer` header for scripts
`PLAKAR_REPOSITORY_PASSPHRASE`	The key that encrypts the repository. Copy it to your password manager now: if the instance is lost, this passphrase and a copy of the repository are what you need to restore. It is also stored in `/etc/plakar/repo.key` (root and the Plakar service only) so the services and `sudo plakar` can open the repository without prompting
`PLAKAR_CERT_SHA256`	The certificate fingerprint to compare with the one your browser shows

Plakar 1.1.8 has no command to change a repository's passphrase: the passphrase generated on first boot stays with the repository for its lifetime. Keep it as safe as you would the data itself.

Step 5: Open the web UI

Open PLAKAR_URL from Step 4 in your browser. Your browser will warn about the certificate the first time, because it is self signed for this instance; compare the fingerprint the browser shows with PLAKAR_CERT_SHA256 before you accept it, or use your own DNS name (Step 9). The link sets a secure, HTTP only cookie for this site, and the UI keeps the token in the browser's local storage for its API calls, so after the first visit https://<host>/ is enough. Open the link only on a browser profile you do not share; Step 9 shows how to replace the token.

To keep port 443 closed to the internet, reach the UI through SSH instead. The UI checks that a browser request comes from the name it is served as, so forward local port 443 (which needs sudo on your workstation) and browse to https://localhost/?plakar_token=<your-token>:

sudo ssh -i <your-key.pem> -N -L 443:localhost:443 ubuntu@<public-ip>

The Dashboard shows the repository and the latest restore points:

Plakar web UI dashboard with one restore point of /etc

Restore points lists every snapshot in the repository:

Plakar web UI Restore points page

Open a restore point to browse its files, preview them and download or restore them:

Plakar web UI browsing the /etc restore point

Integrations lists Plakar's optional connectors for other sources and storage (S3, SFTP, databases and more). Installing them from the UI needs a free plakar.io account; the backup, browse and restore features in this guide do not. The integrations run as the Plakar service account, so the egress firewall (Step 8) applies to them:

Plakar web UI Integrations page

Step 6: Back up and restore from the command line

sudo plakar uses the repository through the local repository service, with the passphrase read from /etc/plakar/repo.key. This makes a small directory, backs it up and lists the result:

sudo mkdir -p /tmp/plakar-demo
echo "hello from cloudimg" | sudo tee /tmp/plakar-demo/hello.txt >/dev/null
sudo plakar backup /tmp/plakar-demo 2>&1 | tail -1
sudo plakar ls

20f3b426: backup completed without errors in 124.945084ms (in: 0 B, out: 1.6 MiB)
2026-11-07T23:07:34Z   20f3b426      20 B        0s /tmp/plakar-demo

The second column is the snapshot ID. List the files in the snapshot, check it, and restore it to a new directory:

ID=$(sudo plakar ls | awk '$NF == "/tmp/plakar-demo" {print $2; exit}')
sudo plakar ls "$ID:/tmp/plakar-demo"
sudo plakar check "$ID" 2>&1 | tail -1
sudo plakar restore -to /tmp/plakar-restore "$ID" 2>&1 | tail -1
sudo cat /tmp/plakar-restore/hello.txt

2026-11-07T23:07:33Z -rw-r--r--     root     root     20 B hello.txt
20f3b426: check completed without errors in 10.131786ms (in: 2.2 KiB, out: 0 B)
20f3b426: OK ✓ /hello.txt
hello from cloudimg

The snapshot also appears on the web UI's Restore points page. Removing a snapshot needs -apply; without it plakar rm only shows what it would remove:

sudo plakar rm -apply "$ID" 2>&1 | tail -1
sudo rm -rf /tmp/plakar-demo /tmp/plakar-restore

info: rm: removal of 20f3b426 completed successfully

Back up the directories that matter on the instance the same way, for example sudo plakar backup /etc or sudo plakar backup /srv. A file system you mount on the instance (an Amazon EFS or NFS share, another EBS volume) is backed up with the same command. To schedule backups, add a root cron entry or a systemd timer that runs plakar backup.

The repository can only be opened with its passphrase:

echo not-the-passphrase > /tmp/wrong.key
sudo plakar -keyfile /tmp/wrong.key at /var/lib/plakar/repo ls 2>&1 | tail -1
rm -f /tmp/wrong.key

plakar: failed to unlock repository

Step 7: Keep a copy of the repository off the instance

The repository is a directory of encrypted files on the data volume, /var/lib/plakar/repo. The simplest second copy is an EBS snapshot of that volume, taken with the AWS CLI on your workstation (not on the instance) or on a schedule with Amazon Data Lifecycle Manager:

aws ec2 create-snapshot --region <region> --volume-id <data-volume-id> \
  --description "plakar repository" \
  --tag-specifications 'ResourceType=snapshot,Tags=[{Key=Name,Value=plakar-repo}]'

To restore from it on a new instance, create a volume from the snapshot and attach it in place of the data volume, then keep the PLAKAR_REPOSITORY_PASSPHRASE you saved in Step 4: the repository opens with that passphrase, not with the new instance's.

Step 8: Check the security posture

Everything but the health check needs the token, a request for a host name the instance does not serve is dropped without an answer, and nothing answers on port 80:

H=$(sudo sed -n 's/^PLAKAR_HOST=//p' /root/plakar-credentials.txt)
C=/etc/plakar/tls/plakar.crt
sudo curl -s --cacert $C -o /dev/null -w 'web UI, no token     -> HTTP %{http_code}\n' https://$H/
sudo curl -s --cacert $C -o /dev/null -w 'API, no token        -> HTTP %{http_code}\n' https://$H/api/repository/snapshots
printf 'header = "Authorization: Bearer %s"\n' "$(openssl rand -hex 24)" | sudo curl -s --cacert $C -K - -o /dev/null -w 'API, wrong token     -> HTTP %{http_code}\n' https://$H/api/repository/snapshots
sudo curl -s --cacert $C -o /dev/null -w 'health check         -> HTTP %{http_code}\n' https://$H/healthz
curl -sk -H 'Host: other.example' -o /dev/null -w 'unknown host         -> %{http_code}\n' https://127.0.0.1/healthz || true
curl -s -o /dev/null -w 'plain http :80       -> %{http_code}\n' --connect-timeout 3 http://127.0.0.1/ || true

web UI, no token     -> HTTP 401
API, no token        -> HTTP 401
API, wrong token     -> HTTP 401
health check         -> HTTP 200
unknown host         -> 000
plain http :80       -> 000

000 means no answer: nginx closes the connection for a host name it does not serve, and nothing listens on port 80. The certificate directory is readable by root only, hence sudo curl.

With the token the API answers (here with one snapshot, a backup of /etc, in the repository). The token is handed to curl on standard input, so it never appears in the process list:

sudo bash -c '
  H=$(sed -n "s/^PLAKAR_HOST=//p" /root/plakar-credentials.txt)
  T=$(sed -n "s/^PLAKAR_UI_TOKEN=//p" /root/plakar-credentials.txt)
  printf "header = \"Authorization: Bearer %s\"\n" "$T" | curl -s --cacert /etc/plakar/tls/plakar.crt -K - https://$H/api/repository/snapshots | jq "{total, latest}"'

{
  "total": 1,
  "latest": null
}

The certificate is a leaf for the instance's names:

sudo openssl x509 -noout -ext subjectAltName,basicConstraints,keyUsage,extendedKeyUsage -in /etc/plakar/tls/plakar.crt

X509v3 Subject Alternative Name: 
    DNS:ec2-18-233-158-68.compute-1.amazonaws.com, IP Address:18.233.158.68, IP Address:172.31.83.183, IP Address:127.0.0.1, DNS:localhost
X509v3 Basic Constraints: critical
    CA:FALSE
X509v3 Key Usage: critical
    Digital Signature, Key Encipherment
X509v3 Extended Key Usage: 
    TLS Web Server Authentication

Two firewall chains are hooked into the output path: the loopback gate for the Plakar ports and the egress firewall for every process running as the plakar user:

sudo iptables -S OUTPUT | grep CLOUDIMG
sudo iptables -S CLOUDIMG-PLAKAR-EGRESS | grep -E '^-A' | grep -v icmp

-A OUTPUT -o lo -j CLOUDIMG-PLAKAR-LOOP
-A OUTPUT -m owner --uid-owner 997 -j CLOUDIMG-PLAKAR-EGRESS
-A CLOUDIMG-PLAKAR-EGRESS -d 127.0.0.0/8 -o lo -j RETURN
-A CLOUDIMG-PLAKAR-EGRESS -d 169.254.0.0/16 -p tcp -j REJECT --reject-with tcp-reset
-A CLOUDIMG-PLAKAR-EGRESS -d 0.0.0.0/8 -p tcp -j REJECT --reject-with tcp-reset
-A CLOUDIMG-PLAKAR-EGRESS -d 100.64.0.0/10 -p tcp -j REJECT --reject-with tcp-reset
-A CLOUDIMG-PLAKAR-EGRESS -d 10.0.0.0/8 -p tcp -j REJECT --reject-with tcp-reset
-A CLOUDIMG-PLAKAR-EGRESS -d 172.16.0.0/12 -p tcp -j REJECT --reject-with tcp-reset
-A CLOUDIMG-PLAKAR-EGRESS -d 192.168.0.0/16 -p tcp -j REJECT --reject-with tcp-reset

Refused connections are reset at once rather than silently dropped, so a storage URL that names an internal address fails immediately. Try it as the plakar user: the metadata service and a private address are refused, Amazon S3 is reachable:

for t in http://169.254.169.254/latest/meta-data/ http://10.0.0.1/ https://s3.amazonaws.com/; do
  if code=$(sudo setpriv --reuid=plakar --regid=plakar --clear-groups -- curl -s -m 10 -o /dev/null -w '%{http_code}' "$t"); then echo "$t -> HTTP $code"; else echo "$t -> refused"; fi
done

http://169.254.169.254/latest/meta-data/ -> refused
http://10.0.0.1/ -> refused
https://s3.amazonaws.com/ -> HTTP 307

The loopback gate keeps every other local account off the repository and UI ports, so nothing on the instance can bypass nginx's token check or talk to the repository service directly. Try it as the unprivileged nobody account (your ubuntu login is refused in the same way; only root, nginx and the Plakar service account get through):

for p in 9876 9877; do
  if sudo setpriv --reuid=nobody --regid=nogroup --clear-groups -- curl -s -m 5 -o /dev/null http://127.0.0.1:$p/; then echo "nobody -> 127.0.0.1:$p answered"; else echo "nobody -> 127.0.0.1:$p refused"; fi
done

nobody -> 127.0.0.1:9876 refused
nobody -> 127.0.0.1:9877 refused

Both Plakar services run as the unprivileged plakar user. The repository service may reach loopback only; the web UI carries the refused ranges as a cgroup IPAddressDeny list (a second block that does not depend on iptables); nginx and the first boot service cannot reach the metadata service:

ps -o user:8=,args= -C plakar | cut -c1-90
systemctl show plakar-store plakar-ui nginx plakar-firstboot -p Id -p IPAddressDeny -p IPAddressAllow

plakar   /opt/plakar/plakar -cachedir /var/lib/plakar/cache-store -keyfile /etc/plakar/rep
plakar   /opt/plakar/plakar -cachedir /var/lib/plakar/cache-ui -keyfile /etc/plakar/repo.k
plakar   /opt/plakar/plakar -cachedir /var/lib/plakar/cache-ui cached
IPAddressAllow=127.0.0.0/8 ::1/128
IPAddressDeny=::/0 0.0.0.0/0
Id=plakar-store.service

IPAddressAllow=
IPAddressDeny=169.254.0.0/16 168.63.129.16/32 ::ffff:0.0.0.0/96 fe80::/10 0.0.0.0/8 192.168.0.0/16 172.16.0.0/12 100.64.0.0/10 10.0.0.0/8 fc00::/7 64:ff9b::/96 64:ff9b:1::/48
Id=plakar-ui.service

IPAddressAllow=
IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32
Id=nginx.service

IPAddressAllow=
IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32
Id=plakar-firstboot.service

The rules are applied by cloudimg-plakar-egress.service in one atomic iptables-restore transaction per address family: a reload replaces the chains in a single step, a reload that fails leaves the previous rules in place, and stopping the unit does not remove them. sudo systemctl reload cloudimg-plakar-egress re-applies them. The firewall covers the Plakar services, not your own sudo plakar commands, which run as root with your administrator's access to the network.

Storage on a private address. If you point an integration at storage inside your network (a MinIO server, a NAS), allow that host first. plakar-egress-allow accepts a private address or network (inside the refused ranges above; allow the single host, /32, rather than a whole range), refuses the metadata service, link local addresses and anything that is not private, updates both the iptables rules and the cgroup block, and restarts the web UI:

sudo plakar-egress-allow add 10.20.30.40/32
sudo plakar-egress-allow list
sudo plakar-egress-allow remove 10.20.30.40/32

Step 9: Rotate the token, use your own DNS name

sudo plakar-rotate-token replaces the web UI token with a new random one, writes it and the new link to /root/plakar-credentials.txt, and applies it at once: the old token, links and cookies stop working, and you open the new PLAKAR_URL in your browser. It is also the lockout recovery: it rebuilds nginx's token gate if it was damaged and recreates the credentials file if it was deleted (the repository passphrase is taken from /etc/plakar/repo.key).

sudo plakar-rotate-token

plakar-rotate-token: new web UI token written to /root/plakar-credentials.txt (PLAKAR_UI_TOKEN, PLAKAR_URL)

Point a DNS record at the instance, then set the name it is served as. This mints a new self signed leaf certificate for the name (and the instance's IP addresses), updates nginx and the URL in the credentials file, and keeps the name across reboots. The certificate fingerprint changes, so compare the new PLAKAR_CERT_SHA256 the next time your browser asks:

sudo plakar-set-hostname <your-domain>

Step 10: Server components

Component	Path
Plakar application	`/opt/plakar/plakar` (read only, owner root; `plakar` on the PATH)
Licence and build provenance	`/usr/share/doc/plakar/`
Repository and caches	`/var/lib/plakar` (data volume; repository in `/var/lib/plakar/repo`)
Repository passphrase	`/etc/plakar/repo.key` (mode 0640, root and the `plakar` group)
Web UI token (service environment)	`/etc/plakar/ui.env` (mode 0600)
Root's store configuration	`/root/.config/plakar/stores.yml` (default store `cloudimg`)
Service units	`plakar-store.service`, `plakar-ui.service`, `cloudimg-plakar-egress.service`, `plakar-firstboot.service` in `/etc/systemd/system/`
Firewall rules	`/usr/local/sbin/plakar-egress-apply` (`--print` shows the ruleset), allowed hosts in `/etc/cloudimg/plakar-egress-allow`
nginx site and token gate	`/etc/nginx/sites-available/cloudimg-plakar`, `/etc/nginx/plakar-gate.conf` (mode 0600)
Certificate and key	`/etc/plakar/tls/`
Helpers	`/usr/local/sbin/plakar-rotate-token`, `plakar-set-hostname`, `plakar-egress-allow`, `plakar-guard`
Credentials	`/root/plakar-credentials.txt` (mode 0600)

sudo plakar version
grep -E '^(source|toolchain|changes)' /usr/share/doc/plakar/BUILD-PROVENANCE.txt | cut -c1-120
nginx -v 2>&1

plakar/v1.1.8
source:    https://github.com/PlakarKorp/plakar/archive/refs/tags/v1.1.8.tar.gz (tag commit 4ded890fd4fb48f539ea95bf5291
toolchain: go1.27.3 linux/amd64 (https://go.dev/dl/go1.27.3.linux-amd64.tar.gz, sha256 65efbc80fdc1fa2cd2631cad5b481777a
changes:   dependency raise only (go.mod, no source patch): github.com/yuin/goldmark@v1.7.17 google.golang.org/grpc@v1.8
nginx version: nginx/1.24.0 (Ubuntu)

Logs: sudo journalctl -u plakar-store -u plakar-ui for the services, /var/log/nginx/access.log for requests (with the real client address, and without query strings, so links with a token are never logged).

Step 11: Security recommendations

Allow ports 22 and 443 in the security group from your own networks only, or use the SSH tunnel (Step 5) for the web UI.
Store PLAKAR_REPOSITORY_PASSPHRASE outside the instance. Without it no one, including cloudimg, can open the repository.
Keep a second copy of the repository: EBS snapshots of the data volume (Step 7).
Run sudo plakar check <snapshot-id> from time to time to check that backups can be read back.
Use your own DNS name (Step 9), and rotate the token when someone leaves or the link may have been exposed.
Keep the operating system patched; unattended security upgrades are on, and sudo apt-get update && sudo apt-get upgrade applies everything else.

Support and licensing

Plakar is open source under the ISC licence; there is no per user or per CPU licence fee. The licence is in /usr/share/doc/plakar/. cloudimg is not affiliated with or endorsed by the Plakar project or Plakar Korp. The AMI price covers cloudimg's hardening, first boot setup and support.

Email: support@cloudimg.co.uk
Website: https://www.cloudimg.co.uk
Support: 24/7, with a 24 hour response SLA