Unchained Engine, a headless ecommerce engine that exposes your whole shop as one GraphQL API, with a browser admin console ready the moment it boots.
Unchained Engine is an open source headless commerce engine. Instead of shipping a storefront and asking you to bend it into shape, it gives you the commerce domain itself as a single GraphQL API: products and variants, assortments and filters, carts and orders, quotations, subscriptions and enrollments, pricing and discounts, delivery, payment and warehousing, plus users, roles and a background work queue. Your storefront, mobile app, point of sale terminal or kiosk is whatever you choose to build against that API, in whatever framework you like.
Because the engine is headless, it also ships a full browser admin console for the people who actually run the shop: creating and publishing products, organising assortments, working through orders and quotations, managing customers and roles, and importing or exporting catalogue data in bulk. This image runs the engine and its datastore together on one machine, so an evaluation, a development backend or a small production shop is a single deployment rather than a stack you have to assemble.
Unchained is a framework, so a working deployment normally means writing a host application, wiring up a datastore, choosing plugins and building the admin console before you can see a single screen. cloudimg ships all of that finished and proven: the engine, its datastore and the admin console are installed, configured and running together, and the appliance is validated end to end before release by creating a product through the API, reading it back and confirming it was persisted, not merely by checking that a page loads. Security is the default rather than an exercise for the reader. Upstream's example applications ship a published administrator password and published signing secrets; none of them exist here. Every instance mints its own administrator, its own session and signing secrets and its own database passwords on first boot, written to a file only root can read, and the image itself contains no account at all, so there is nothing to guess before that first boot completes. The datastore and the engine both listen on the loopback interface only, so a single hardened front door is the only thing exposed, and the session cookie policy is set for real browser sign in rather than the sandbox defaults that silently make login impossible. The base is fully patched with unattended security upgrades enabled, and every deployment is paired with a step by step deploy guide tested against the exact image you launch and backed by 24/7 cloudimg support.
Real screenshots taken while testing this image against its deployment guide.