Base
Hardened build
minimal ports, security patches applied at build time
PatchMon on Ubuntu 24.04 LTS
Azure
Security
PatchMon, a self hosted patch management platform that shows which of your Linux hosts are behind on updates and lets you patch them from one console.
Overview
PatchMon is a self hosted patch management platform for Linux fleets. A single server keeps an inventory of every package installed across the hosts you register with it, highlights which of them have outstanding security and regular updates, and turns that into a fleet wide view of your patch posture. You can group hosts, schedule and run patching jobs against a group or a single machine, set alerts and notifications for hosts that fall behind or go quiet, and report on what was patched and when.
It is worth being precise about the architecture, because it decides how you deploy it. PatchMon is a server plus agent product, and this image is the server. You register each machine you want managed by running a one line command that PatchMon generates for you in the console, which installs the small agent and points it back at this instance. The server then holds the inventory, the schedules and the history; the agents report package state and carry out the patching work on their own hosts. Nothing is baked into the image that ties it to a particular fleet, so the instance you launch is genuinely yours from the first boot.
Beyond package inventory it also collects Windows update metadata, runs SCAP based compliance scanning against bundled security guide content, and provides an in browser remote console for hands on work on a managed host without leaving the interface.
Why the cloudimg image
A patch management server is a high value target: it holds an inventory of exactly which of your machines are unpatched and, in many deployments, the means to run commands on them. Shipping one with a known default administrator would be difficult to justify, so cloudimg does not. PatchMon seeds no user accounts at all, and the captured image contains no database, no registered host, no enrolment token and no usable secret. On the first boot of every instance a fresh database is initialised, the database and cache passwords and the signing and encryption keys are all regenerated, and a single administrator account unique to that instance is created and written to a file readable only by root. No two deployments share a credential.
The instance also configures itself correctly for its own address. PatchMon stores the server URL that its generated agent install commands point at in its database, where a stale value is easy to miss and would send every agent to the wrong place; first boot detects the instance address and writes it into that setting, so the enrolment command the console hands you works as printed. The full stack is installed and supervised by systemd, the server binary is verified by checksum against the official upstream release at install time, and the base carries unattended security upgrades.
Common uses
- See which Linux hosts across your fleet have outstanding security updates
- Schedule and run patching jobs against a host group from one console
- Report on fleet patch posture and prove what was patched and when
See it running
Real screenshots taken while testing this image against its deployment guide.
More in Security
AliasVault Self-Hosted Password Manager & Aliases
Security
The cloudimg image ships the free and open source, AGPL-3.0 licensed AliasVault, run the officially supported way as the...
Apache Directory Server LDAP - Managed Support
Security
This image runs Apache Directory Server (ApacheDS) 2.0, the Apache Software Foundation's extensible, embeddable director...
Apache SpamAssassin Anti-Spam Filter
Security
This image runs Apache SpamAssassin, the open source, Apache-2.0 licensed anti-spam platform.
Authentik - Self-Hosted Identity Provider and SSO Platform
Security
Authentik is an open source identity provider: single sign-on, multi-factor authentication, user management and access c...
Authgear - Open Source Identity Provider
Security
This image runs Authgear, the open source authentication server and identity provider.
Bl
Beelzebub Low-Code Honeypot Framework
Security
This image runs Beelzebub, the open source low code honeypot and deception framework.