OpenAPI Generator on Ubuntu 24.04 LTS
by cloudimg
Generate client SDKs and server stubs from your API spec, behind per instance credentials.
OpenAPI Generator turns an OpenAPI specification into working code. Hand it your API description and it returns a client SDK, a server stub or a documentation set, ready to unpack and use, across more than 150 language and framework targets. This image is the service form of it: a REST API your build pipeline can call, and an interactive console in the browser for the times you just want a client for something right now.
Why run it yourself. An internal API description is design documentation for your system. A private generator keeps it inside your own network while still giving every team the same generated clients, from the same generator version, in every pipeline.
What you get. OpenAPI Generator Online 7.25.0 on Ubuntu 24.04 LTS, the unmodified upstream artefact from Maven Central pinned by version and by SHA-256, run by systemd as an unprivileged service account on OpenJDK 21 from the Ubuntu archive. A working generator is available within minutes of launch with no manual configuration.
Authentication it does not have on its own. The upstream service is published as an open demo and has no login, no token and no user model of any kind. That matters more here than on most appliances, because the service accepts a document or a URL from its caller and writes files derived from it. This image puts the whole of it behind TLS with an HTTP basic credential and no exemptions: the generation API, the interactive console, the API document and the archive download are all gated, and the generator itself is bound to the loopback interface where nothing outside the instance can reach it.
No shared credential, and no default left behind. On each instance's first boot a unique password is generated for that instance alone, stored only as a salted hash, and written to a file only the root user can read, together with a TLS certificate naming that instance. The service stays closed until that has finished. No two deployments share a credential.
Bounded, and confined. The generator runs as a dedicated service account with one writable directory, and everything it produces is written there and nowhere else. A scheduled sweep clears generated archives once their download links have expired and enforces a hard ceiling on disk use, so a long-running instance cannot fill its disk however heavily it is used. Fetching a specification by URL keeps working, but the service cannot reach the instance metadata service or anything inside your private network while doing it. An on-instance self test generates a client through the real front door, checks the archive it gets back file by file, removes it, and confirms every refusal the front door is supposed to make - and each of its checks is itself tested against a known-bad input first.
Licensing and trademarks. OpenAPI Generator is free software under the Apache License 2.0, with no subscription or licence key. OpenAPI is a trademark of the Linux Foundation. All product and company names are trademarks or registered trademarks of their respective holders; cloudimg is not affiliated with, endorsed by or sponsored by the OpenAPI Initiative, the Linux Foundation or the OpenAPI Generator project, and packages the unmodified open source software. The cloudimg charge of $0.04 per vCPU/hour covers packaging, hardening and 24/7 support.