Karapace on Ubuntu 24.04 LTS

Azure Streaming & Messaging

Karapace, an open source schema registry and Kafka REST proxy, bundled with a ready to use single node Kafka broker so it is useful the moment it boots.

Base
Hardened build
minimal ports, security patches applied at build time
Access
Unique credentials
generated on first boot, readable only by root
Verified
Boots working
services pass a health gate before release
Support
24/7, 365 days
by email and live chat, 24 hour response SLA

Overview

Karapace is an open source implementation of the Schema Registry and Kafka REST Proxy APIs. The registry gives your event streams a central, versioned contract: producers and consumers store Avro, JSON Schema and Protobuf schemas under a subject, every schema keeps its own version history, and the registry checks each proposed change against a compatibility rule so a breaking change is caught before it reaches production rather than after a consumer has already failed on it. The REST proxy exposes the same cluster over plain HTTP, so any client that can make a web request can list topics, produce messages and consume them without a native Kafka driver.

Because it implements the same APIs as the widely used Confluent equivalents, existing client libraries and tooling point at it unchanged. It suits teams standardising the contracts between services on Kafka, anyone who needs schema governance and compatibility enforcement they host themselves, and applications in languages with no first class Kafka client that still need to read and write events over HTTP.

Why the cloudimg image

A schema registry is useless without a broker to store schemas in, so cloudimg ships one: a single node Apache Kafka broker in KRaft mode is bundled and wired up, making this a self contained working appliance rather than a component that needs a cluster before it does anything. The image is secure by default, which matters here because an open registry lets anyone read, overwrite or delete every schema your producers and consumers depend on: both APIs sit behind HTTP Basic authentication whose password is generated uniquely on each instance's first boot and written to a root only file, and both services are bound to the loopback interface so that authentication cannot be bypassed. The bundled broker is never exposed to the network, and each instance formats its own empty cluster on first boot, so no two deployments share a cluster identity or any leftover build data. No compiler or build toolchain ships in the image. Every deployment is paired with a step by step deploy guide and backed by 24/7 cloudimg support.

Common uses

  • Enforce Avro, JSON Schema and Protobuf contracts across Kafka producers and consumers
  • Catch breaking schema changes with compatibility checks before they reach production
  • Produce to and consume from Kafka over plain HTTP with no native client