Hatchet - Distributed Task Queue and Workflow Engine

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

Hatchet is an open-source distributed task queue and background job engine for durable workflow orchestration. Define workflows and tasks in code with your existing language SDK, and Hatchet runs them across a fleet of workers with automatic retries, concurrency and rate limits, fan-out and scheduling - then shows you every run, worker, event and schedule in a modern web dashboard. This AMI delivers Hatchet fully installed and secured so a working orchestration engine is operational within minutes of launch.

## Why This Image vs. a Manual Install

Running Hatchet yourself means standing up Docker, a PostgreSQL datastore, a RabbitMQ message broker and the Hatchet engine, wiring them together on a private network, generating encryption keysets and cookie secrets, and removing the well-known default administrator the stock compose seeds. This image completes every one of those steps at build time. Launch the instance, read your unique credential, and sign in - no configuration files to edit.

## Application Stack

Hatchet is delivered as the official all-in-one engine, API and dashboard container, pinned by digest, alongside a bundled PostgreSQL and RabbitMQ, also pinned by digest and reachable only inside a private container network. Docker Engine and its data root - including every pre-pulled image and the database and broker state - live on a dedicated, independently resizable data volume separate from the OS disk. systemd brings the whole stack up on boot and restarts it on failure. The dashboard and API are served behind nginx over TLS.

## Security Hardening

This image follows a defence-in-depth approach:

• No default or shared credentials: the well-known default administrator is never created; a unique administrator with a cryptographically random password is generated on each instance's first boot and written only to a root-only file
• Per-instance secrets: the PostgreSQL password, RabbitMQ password, encryption master keyset, JWT keysets and cookie secrets are all generated per instance on first boot, never shipped in the image
• Closed registration: open sign-up and tenant creation are disabled so the instance cannot be seized; new members join by administrator invitation only
• Network isolation: the engine, dashboard and API bind exclusively to the loopback interface; PostgreSQL and RabbitMQ are never published to a host port; only the nginx reverse proxy is exposed, over TLS
• Dedicated data volume: the Docker data root, workflow database and broker state live on their own disk, surviving OS-disk changes and resizable independently
• Automatic restart: systemd monitors the stack and restarts it on failure

Buyers requiring formal compliance documentation should contact cloudimg to discuss specific requirements.

## Concrete Use Cases

• Reliable background jobs for a web application: offload email sending, PDF generation, billing and webhook delivery from the request path onto durable Hatchet tasks with automatic retries, so a transient failure never loses work
• AI and data pipelines: orchestrate multi-step retrieval, model inference and post-processing as a workflow with concurrency limits and fan-out, observing every run and worker in the dashboard
• Scheduled and event-driven automation: run cron-style schedules and event-triggered workflows across a fleet of workers, with per-run visibility into status, timing and failures

## AWS Integration

Deploy on any EC2 instance type; the recommended size is m5.large. Use the unauthenticated liveness endpoint with an Application Load Balancer for health monitoring. Back up the workflow database and broker state using EBS snapshots or AWS Backup, and resize the dedicated data volume independently of the OS disk as your throughput grows. Connect external workers over the engine gRPC port once you open it in the security group.

## Getting Started

1. Launch the AMI on an m5.large (or larger) EC2 instance.

2. Read your unique administrator credential from the root-only file on the instance.

3. Open the web dashboard in your browser over TLS and sign in.

4. Create an API token and point your Hatchet SDK workers at the instance.

5. Define your first workflow in code, run it, and watch every step in the dashboard.

For a guided walkthrough or help planning your deployment architecture, book a free consultation with cloudimg at support@cloudimg.co.uk.

## About cloudimg

cloudimg publishes pre-hardened, production-ready AMIs on AWS Marketplace and provides 24/7 technical support by email and live chat. Every AMI is built with unique per-instance credentials, network isolation, and dedicated data volumes so teams can move to production without manual hardening.