MatrixOne 4.2.6

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick MatrixOne 4.2.6 on Ubuntu 24.04 as the software version and choose your Region. Then choose Launch through EC2.

Choose m5.large (or larger for analytical work), your key pair and a security group as described in Prerequisites. The AMI has two volumes: the root volume and a 20 GiB data volume (/dev/sdf) for /var/lib/matrixone. At launch, make the data volume as large as your data needs.

To launch with the AWS CLI, replace the values in angle brackets. This example grows the data volume to 100 GiB:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --block-device-mappings 'DeviceName=/dev/sdf,Ebs={VolumeSize=100,VolumeType=gp3}' \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=matrixone}]'

If you make the data volume larger at launch, grow the file system once after first boot with sudo resize2fs "$(findmnt -no SOURCE /var/lib/matrixone)". First boot takes under a minute once the instance is running.

Connect over SSH. For MatrixOne 4.2.6 on Ubuntu 24.04, the SSH user is ubuntu.

ssh -i <your-key.pem> ubuntu@<public-ip>

Check that both the first-boot service and MatrixOne itself are active:

systemctl is-active matrixone-firstboot.service matrixone.service

active active

Every MatrixOne port listens on the loopback address. From the network, only SSH is reachable:

sudo ss -Htln

LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0:* LISTEN 0 4096 127.0.0.1:22000 0.0.0.0:* LISTEN 0 4096 127.0.0.1:22001 0.0.0.0:* LISTEN 0 4096 127.0.0.1:22002 0.0.0.0:* LISTEN 0 4096 127.0.0.1:6001 0.0.0.0:* LISTEN 0 4096 127.0.0.1:6002 0.0.0.0:* LISTEN 0 4096 127.0.0.1:6003 0.0.0.0:* LISTEN 0 4096 127.0.0.54:53 0.0.0.0:* LISTEN 0 4096 127.0.0.1:19998 0.0.0.0:* LISTEN 0 4096 127.0.0.1:32000 0.0.0.0:* LISTEN 0 4096 127.0.0.1:32001 0.0.0.0:* LISTEN 0 4096 127.0.0.1:32002 0.0.0.0:* LISTEN 0 4096 0.0.0.0:22 0.0.0.0:* LISTEN 0 4096 [::]:22 [::]:*

6001 is the MySQL-protocol port. The others are MatrixOne's internal services: log service 32000 to 32002, transaction node 22000 to 22002, compute node 6002 and 6003, and query service 19998. The two port 53 lines are Ubuntu's local DNS resolver, also loopback only.

Read the credentials file as root:

sudo cat /root/matrixone-credentials.txt

# MatrixOne 4.2.6 on Ubuntu 24.04 - generated on first boot by matrixone-firstboot.service
# These passwords are unique to this instance; none was baked into the image. Keep this file secret. MATRIXONE_HOST=127.0.0.1 MATRIXONE_PORT=6001 MATRIXONE_ROOT_USER=root MATRIXONE_ROOT_PASSWORD=<MATRIXONE_ROOT_PASSWORD> MATRIXONE_DUMP_USER=dump MATRIXONE_DUMP_PASSWORD=<your-dump-password> MATRIXONE_SERVER_VERSION=8.0.30-MatrixOne-v4.2.6
# On the instance (the mysql client signed in as root; the password never goes on a command line):
#
sudo matrixone-mysql demo
# From your computer, through an SSH tunnel (MatrixOne listens on 127.0.0.1:6001 only):
# ssh -i <your-key.pem> -N -L 6001:127.0.0.1:6001 ubuntu@<public-ip>
# mysql -h 127.0.0.1 -P 6001 -u root -p
# User guide: https://secureanycloud.com/stacks/matrixone-4-2-6/

root is MatrixOne's administrator in the sys tenant. dump is the second built-in account that upstream creates. It has its own password, so the two accounts never share one.

The matrixone-mysql helper runs the mysql client signed in as root, with the password from the credentials file. It passes the password to the client in a temporary root-only option file, not on the command line:

sudo matrixone-mysql demo -e 'SELECT version(); SELECT current_user();'

version() 8.0.30-MatrixOne-v4.2.6 current_user() root@localhost

Run sudo matrixone-mysql demo with no -e for an interactive session.

First boot created a small table, demo.articles, with a vector column (embedding VECF32(3)) and a full-text index on body. List the article titles:

sudo matrixone-mysql demo -e 'SELECT id, title FROM articles;'

id title 1 Getting started 2 Vector search 3 Full-text search

Vector search

Find the rows with the embedding nearest to a query vector:

sudo matrixone-mysql demo -e "SELECT id, title, l2_distance(embedding, '[0.85,0.8,0.75]') AS distance FROM articles ORDER BY distance LIMIT 2;"

id title distance 2 Vector search 0.07071065157651901 3 Full-text search 0.6964194178581238

Full-text search

Match rows with the full-text index:

sudo matrixone-mysql demo -e "SELECT id, title FROM articles WHERE MATCH(body) AGAINST('columns');"

id title 2 Vector search

Ordinary MySQL-style SQL works for your own data. Create a database and a table, insert rows and query the totals per customer:

sudo matrixone-mysql -e "CREATE DATABASE IF NOT EXISTS shop; CREATE TABLE IF NOT EXISTS shop.orders (id INT PRIMARY KEY, customer VARCHAR(50), amount DECIMAL(10,2)); INSERT INTO shop.orders VALUES (1,'alice',19.99),(2,'bob',5.00),(3,'alice',42.50) ON DUPLICATE KEY UPDATE amount=VALUES(amount); SELECT customer, count(*) AS orders, sum(amount) AS total FROM shop.orders GROUP BY customer ORDER BY customer;"

customer orders total alice 2 62.49 bob 1 5.00

For applications, create a dedicated account instead of using root. For example, run CREATE USER app IDENTIFIED BY '<password>'; and then the GRANT statements that your application needs. MatrixOne grants privileges through roles: CREATE ROLE, GRANT ... TO ROLE, GRANT <role> TO <user>.

MatrixOne listens on 127.0.0.1:6001 only. Forward the port over SSH from your computer, then point any MySQL client or driver at your local end of the tunnel:

ssh -i <your-key.pem> -N -L 6001:127.0.0.1:6001 ubuntu@<public-ip> mysql -h 127.0.0.1 -P 6001 -u root -p

Enter the root password from Step 4 when prompted. For applications inside your VPC, the same tunnel (or an SSH-based bastion) keeps the database port closed to the network.

MatrixOne and its first-boot service cannot reach the instance metadata service:

systemctl show -p IPAddressDeny matrixone.service matrixone-firstboot.service

IPAddressDeny=169.254.169.254/32 fd00:ec2::254/128 168.63.129.16/32 IPAddressDeny=169.254.169.254/32 fd00:ec2::254/128 168.63.129.16/32

The MySQL-protocol port is pinned to loopback, and the Iceberg connector and the Prometheus endpoint are off:

grep -E '^(host|port|enable|enable-metric-to-prom) =' /etc/matrixone/launch/cn.toml

host = "127.0.0.1" port = 6001 enable = false host = "127.0.0.1" enable-metric-to-prom = false

Iceberg statements are refused by MatrixOne's feature gate:

{
sudo matrixone-mysql -e 'SHOW ICEBERG CATALOGS' 2>&1 || true; } | grep -o 'ICEBERG_FEATURE_DISABLED.*'

ICEBERG_FEATURE_DISABLED: SHOW ICEBERG CATALOGS is disabled by configuration [account_id=0]

MatrixOne runs unprivileged:

ps -o user:12=,comm= -C mo-service
sudo grep -E '^(CapEff|NoNewPrivs)' /proc/$(systemctl show -p MainPID --value matrixone.service)/status

matrixone mo-service CapEff: 0000000000000000 NoNewPrivs: 1

The image's own round-trip test shows that both per-instance passwords work and the demo searches return the right rows. It also shows that root and dump refuse 111, blank, common and random passwords:

sudo /usr/local/sbin/matrixone-roundtrip.sh | tail -1

OK-matrixone-roundtrip

This shows how MatrixOne was built and what govulncheck found:

grep -E '^(toolchain|govulncheck|source change|unfixed) ' /usr/share/doc/matrixone/BUILD-PROVENANCE.txt

toolchain go1.26.10 linux/amd64, official tarball https://go.dev/dl/go1.26.10.linux-amd64.tar.gz toolchain sha256 ccfe7ae822d2c2f41f4fe7c956199967a4dac22d0ee0d2b2bfdb440aab3b20c5 source change none (upstream source, unmodified) govulncheck v1.9.0, source: Your code is affected by 3 vulnerabilities from 1 module. (GO-2026-5046 GO-2026-5047 GO-2026-5048); binary: Your code is affected by 3 vulnerabilities from 1 module. (GO-2026-5046 GO-2026-5047 GO-2026-5048) unfixed GO-2026-5046, GO-2026-5047, GO-2026-5048 (github.com/hamba/avro/v2: no fixed release exists). Imported only

Security notes

• GO-2026-5046, GO-2026-5047, GO-2026-5048 are denial-of-service advisories (CPU exhaustion, integer overflow, unbounded memory) in the Avro decoder github.com/hamba/avro/v2. No fixed release exists. MatrixOne uses that library only in its Iceberg connector, to read Iceberg manifest files. The connector is off on this image, and every Iceberg statement is refused before any Avro data is read, as shown above. If you turn it on ([cn.frontend.iceberg] enable = true in /etc/matrixone/launch/cn.toml), these advisories apply to the Iceberg tables you query. Point it only at storage you trust.
• MatrixOne cannot reach the instance metadata service, so loading data from S3 cannot use the instance's IAM role. Pass credentials in the statement or stage you create, as Matrix Origin's documentation describes.

Choose a new password and set it. Then update the credentials file, so that matrixone-mysql keeps working:

sudo matrixone-mysql mysql> ALTER USER root IDENTIFIED BY '<new-password>'; mysql> exit
sudo sed -i 's/^MATRIXONE_ROOT_PASSWORD=.*/MATRIXONE_ROOT_PASSWORD=<new-password>/' /root/matrixone-credentials.txt

Use ALTER USER. MatrixOne accepts SET PASSWORD but does not change the password with it. Change dump the same way (ALTER USER dump IDENTIFIED BY '<new-password>';) and update MATRIXONE_DUMP_PASSWORD.

• Back up by snapshotting the data volume, or by copying /var/lib/matrixone with the service stopped (sudo systemctl stop matrixone). MatrixOne also has its own backup tooling and mo-dump for logical dumps. See Matrix Origin's documentation.
• Memory: MatrixOne sets its Go memory limit to about 70 percent of the instance's RAM each time it starts, so it adapts to the instance type you choose. The file service caches are capped at 128 MB (local) and 256 MB (shared) in /etc/matrixone/launch/*.toml. Raise them on large instances for analytical work.
• Logs: run sudo journalctl -u matrixone.service -n 50.
• Configuration lives in /etc/matrixone/launch/. Restart the service after editing it (sudo systemctl restart matrixone). Keep every listen-address and host on 127.0.0.1 unless you deliberately expose a port. Never enable the Prometheus endpoint on a network you do not trust (MatrixOne binds it to every interface).
• Updates: Ubuntu security updates install automatically. MatrixOne is pinned to the version this image was built with. Upgrade it deliberately, after taking a copy of the data volume and reading Matrix Origin's upgrade notes for the release.