Dependency-Track 5.0 on Ubuntu 24.04

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

Overview

Dependency-Track is the OWASP platform for software supply-chain component analysis. It continuously ingests CycloneDX Software Bills of Materials (SBOMs) for your applications and identifies risk across the components they depend on: known vulnerabilities, out-of-date libraries, and policy violations. Instead of scanning code at a single point in time, it maintains a living inventory of every component in every project and re-evaluates that inventory as new vulnerability intelligence arrives. This image delivers Dependency-Track fully installed and running behind an nginx reverse proxy, so a component-analysis platform is serving within minutes of launch.

Why This Image Instead of Self-Deployment

The upstream Dependency-Track project ships with a well-known default admin credential, no reverse proxy, and no separation of data from the operating system disk. Deploying it yourself means installing and tuning PostgreSQL, setting up nginx, hardening the default credential, separating the data tier, and restricting the management ports by hand. This image solves all of that before you first sign in: a production-shaped stack serving in minutes rather than the hours a manual build takes.

Application Stack

The platform runs as an API server on a modern Java runtime (OpenJDK 25, which Dependency-Track 5.x requires), with a single-page web application served by nginx on port 80 and reverse-proxied to the API. A PostgreSQL database holds the component inventory, findings and configuration. A dedicated unprivileged service account owns the runtime, systemd starts it on boot and restarts it on failure, and the management and metrics endpoints are pinned to loopback and kept off the public interface by a host firewall. The database and the API server data directory live on a dedicated data disk so they are independently resizable and separate from the operating system disk.

Component Analysis

Upload a CycloneDX SBOM for a project through the web UI or the API and Dependency-Track builds an inventory of its components, matches them against vulnerability intelligence once you enable the vulnerability sources, and presents the findings by project and by component. Track risk over time, apply policies that flag components by licence, version or vulnerability severity, and integrate SBOM upload into your build pipeline so every release is analysed automatically.

Secure First Boot

On the first boot of your instance a one-shot service generates a fresh administrator password, unique to that instance, rotates the database credential, verifies the new password works and that the default credential no longer does, and writes the login to a file only the root user can read. No shared or default credentials ship in the image.

Ready To Use

Open the web UI in your browser, read the generated credentials, sign in as admin, and create or upload your first project SBOM straight away. A built-in health endpoint answers on the reverse proxy for load-balancer and uptime checks. The data tier lives on a dedicated, independently resizable data disk.

Community Validation

Dependency-Track is an OWASP Flagship project, the highest maturity designation in the OWASP ecosystem, and is widely adopted for software supply-chain risk management.

cloudimg Support

24/7 technical support by email and chat. Help with deployment, SBOM ingestion, vulnerability-source configuration, policy design, CI/CD integration, database and storage maintenance, backup and upgrade planning.

Use Cases

A central component inventory and vulnerability-tracking platform for your organization's applications. Continuous SBOM analysis wired into your CI/CD pipeline so every build is evaluated and gated on policy. Software supply-chain risk and licence-policy governance across many projects and teams.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.