SpiceDB on Ubuntu 24.04 LTS

SpiceDB is an open source permissions database, inspired by the system Google described in its Zanzibar paper. Instead of scattering permission logic through your application code, you store relationships such as "alice is a reader of the roadmap document", describe in a schema how those relations compose into permissions, and ask the server questions at request time: may this user do this thing to this object? It answers a check for a single decision, and lookup queries when you need to filter a list to exactly what someone is allowed to see. Permissions can be computed rather than stored, so granting someone the right to edit a document can grant the right to view it without a second record existing anywhere. Official SDKs are published for Go, Java, JavaScript, Python and Ruby.

What you get. SpiceDB 1.56.2 on Ubuntu 24.04 LTS, installed from the project's own release artifact pinned by version and checksum, together with the official zed command line client. It runs as an unprivileged, systemd-confined service backed by a co-located PostgreSQL 16 so your schema and relationships survive restarts. The gRPC API on port 50051 is the primary interface and the one every SDK speaks; an HTTP and JSON gateway on port 8443 is also enabled for callers that prefer REST. Both serve TLS. A starter schema is written on first boot.

No shared credential, and no way to run without one. SpiceDB requires a pre-shared key to start at all, so there is no permissive default to inherit - and this image never bakes a key in. On each instance's first boot it generates a 256-bit key for that instance alone, together with its database password and its TLS certificate, and writes them to a file only root can read. No key is in the image, no two deployments share one, and the service stays closed until first boot has finished, so there is no window in which it is reachable without a key.

Hardened past the defaults. SpiceDB's own defaults publish a Prometheus and pprof debug endpoint on every interface, and report telemetry to an external endpoint. This image binds that debug endpoint to the loopback interface and disables telemetry outright. Only SSH and the two API ports are reachable from outside the instance; the database and the multi-node dispatch port are never exposed. An on-VM self-test proves the whole posture at any time, and each of its checks is itself tested against a known-bad input first, so a check that has quietly stopped working cannot report success.

Licensing and trademarks. SpiceDB is free software under the Apache License 2.0, with no subscription or licence key. All product and company names are trademarks or registered trademarks of their respective holders; cloudimg is not affiliated with, endorsed by or sponsored by SpiceDB or AuthZed, and packages the unmodified open source software. The cloudimg charge of $0.04 per vCPU/hour covers packaging, hardening and 24/7 support.