Kill Bill on Ubuntu 24.04 LTS

Kill Bill is a mature open source platform for subscription billing and payments, published under the Apache License 2.0. It manages the whole recurring-revenue lifecycle: catalogues and price plans, subscriptions with trials, upgrades, downgrades and cancellations, usage metering, invoice generation and dunning, payments through pluggable gateways, refunds and chargebacks, credits and account balances, and a full audit trail over every change. It is multi-tenant from the ground up, and everything it does over its REST API it also exposes to the Kaui administration console that ships with this image.

This image delivers Kill Bill 0.24.21 with Kaui 4.0.31 on Ubuntu 24.04 LTS. A note on the version number, because it matters: 0.24 is a pre-1.0 version NUMBER, not a pre-1.0 project. The 0.24 line has been Kill Bill's production series for years, across twenty-one patch releases, with a documented security process, and Kill Bill has a production lineage that began at Groupon. Both applications run as unprivileged users in their own Apache Tomcat 9 instances bound to the loopback interface, each on the Java runtime its own upstream supports, with MySQL 8 bound to localhost and nginx as the only network front door.

The image is secure by default and ships with no data and no usable credential. Kill Bill's released artifacts contain a number of well-known defaults intended for evaluation: a built-in administrator, an integration-test mode that exposes a clock the rest of the system bills against, and a session-signing secret shared by every deployment of the release. None of them exists in this image. They are removed when the image is built, and on the first boot of your VM a fresh database is created and the administrator password, the tenant API key and secret, both database passwords, the console's session and encryption keys and the TLS certificate are all generated uniquely on that machine and written to a file only root can read. Nothing serves until that has finished.

Only ports 22, 80 and 443 are reachable from outside. A default-deny host firewall enforces that rather than trusting each component to bind correctly, the reverse proxy overwrites the client address it forwards so Kill Bill's sign-in rate limiting always sees the real caller, and the diagnostic and clock endpoints are refused at the edge as well as disabled in the application.

Kill Bill and Kaui are trademarks of their respective owners; KILL BILL is separately a registered trademark of Miramax LLC for an unrelated film franchise. cloudimg is not affiliated with, endorsed by or sponsored by any of them; this image packages the unmodified open source software. Kill Bill is free software with no subscription or licence key; the cloudimg charge covers packaging, hardening and 24/7 support.