Base
Hardened build
minimal ports, security patches applied at build time
OPAL on Ubuntu 24.04 LTS
Azure
Security
OPAL, the Open Policy Administration Layer, keeping authorization policy in sync across your services in real time.
Overview
OPAL, the Open Policy Administration Layer, keeps authorization policy and the data it reasons over continuously up to date. You keep policy in a git repository; OPAL watches it and pushes every change out to Open Policy Agent the moment it is committed, so applications asking for an authorization decision always get an answer based on the current rules, with no redeploy and no restart.
OPAL on its own is infrastructure rather than a finished system, so this image ships a complete single node appliance: OPAL server, OPAL client and Open Policy Agent, installed, wired together and answering decisions from first boot, with a working example policy repository you can repoint at your own.
Why the cloudimg image
cloudimg ships the whole appliance assembled and proven rather than a bare component, with OPAL installed into an isolated virtual environment and the exact resolved dependency set recorded inside the image. It is secure by default and ships no shared credential: Open Policy Agent is bound to loopback so its unauthenticated API can never be reached, the exposed decision endpoint sits behind nginx with TLS and HTTP basic authentication, and on first boot every instance generates its own master token, signing keypair, client token, certificate and password into a root only file. A built in self test proves the policy round trip end to end, and every instance is backed by a paired deploy guide and 24/7 support.
Common uses
- Distribute authorization policy changes across services in real time
- Run Open Policy Agent with policy managed from a git repository
- Centralise access control decisions for your applications
More in Security
KeePass Password Manager
Security
KeePass is a free, open source password manager that stores all your passwords in a highly encrypted database. The datab...
CrowdSec
Security
This image runs CrowdSec, the free and open source collaborative behavioural security engine.
Ollama GPU-Accelerated LLM Server
Security
This image runs Ollama 0.30, the easiest way to run open large language models locally - pull and serve Llama, Mistral, ...
OWASP ZAP
Security
This image runs OWASP ZAP (the Zed Attack Proxy), the world's most widely used open source web-application security scan...
step-ca
Security
This image runs step-ca, the open source online certificate authority from Smallstep for secure, automated X.509 and ACM...
Trivy Security Scanner
Security
This image runs Trivy, the open source, Apache-2.0 licensed all-in-one security scanner from Aqua Security.