pgagroal, a high performance connection pool for PostgreSQL, shipped with a pooled PostgreSQL backend so it works the moment it boots.
pgagroal is a connection pool that sits in front of a PostgreSQL server and multiplexes client connections onto a much smaller set of reusable backend connections. Applications that open and close database connections rapidly, or that run many short lived workers, otherwise pay PostgreSQL's per connection process cost on every request. pgagroal absorbs that cost once, keeps warm connections ready, validates them in the background, and hands them out in microseconds. It is written in C, uses no threads on the hot path, and speaks the native PostgreSQL protocol, so any client driver works unchanged.
This image is a working pooler rather than a bare binary. A PostgreSQL server is installed as the pooled backend and bound to the loopback interface only, an empty application database and a dedicated non superuser role are created for you, and pgagroal is configured in front of them as the single database endpoint on the network. The same appliance can be repointed at your own PostgreSQL server, or at a managed PostgreSQL service, by editing one section of the pooler configuration.
cloudimg ships a pooler that is already secure and already working. On the first boot of every instance four secrets are generated uniquely for that machine and written to a file only the root user can read: the PostgreSQL superuser password, the pooler's own backend credential, the password your application uses to reach the pool, and the master key that encrypts the credential vault at rest. The password clients use is deliberately different from the password the pooler uses to reach the database, so the backend credential never leaves the machine. Nothing is baked in, and the pooler refuses to start at all until first boot has finished writing those secrets. The database itself listens on the loopback interface only, so the sole database port on the network is the pool, and the remote management, metrics and console listeners ship switched off rather than exposed. The application database ships genuinely empty, with no sample tables and no extra roles. The image is built from the pinned upstream release, verified by checksum, with the compiler removed again afterwards and every shipped binary proven to still resolve its libraries. The base is fully patched with unattended security updates enabled, and every deployment is paired with a step by step deploy guide and backed by 24/7 cloudimg support.