The Hyrax data server is open source, giving you the flexibility to choose how you install and run it. We use continuous integration and continuous delivery (CI/CD) to build our software for every change of the source code.

Hyrax-1.18.0 (July 28, 2026)

What’s New in Hyrax-1.18.0

Security Update

• This release includes changes that resolve CVE-2026-16637

Hyrax Updates

• Server Header: Added the standard HTTP response header Server matching Apache’s formatting (Example: Hyrax/1.18.0-0)
• Floating-Point Compression: Implemented a new configuration option/BES key allowing users to disable compression of large floating-point arrays in the fileout_netcdf handler, significantly lowering the Time to First Byte (TTFB) for data some data requests.
• HDF5 Modernization: Cleaned up legacy HDF5 API support in favor of the latest HDF5 APIs. Sped up dimension name retrieval across almost all scenarios.
• Memory & Performance Profiling: Added valgrind tracking parameters to isolate memory leaks and eliminated various code smells flagged by SonarCloud across multiple PRs.

All the dmr++ things.

In Hyrax-1.18.0 we have greatly improved the dmr++ ecosystem. (The dmr++ is a dataset metadata document that contains both the dataset metadata and the chunk manifest of the source data file. The dmr++ file is relatively small and can be retrieved and utilized locally in lieu of retrieving the entire source data file from the cloud.)

• Direct Chunk IO: Introduced direct chunk IO capabilities for both whole variables and subset cases to optimize S3 data retrieval. This feature can greatly decrease fileout netcdf response times for amenable datasets.
• HDF4 and HDF5 Optimizations: Improved dmr++ build times for HDF4-EOS2 data by one to two orders of magnitude, reducing build times from minutes to seconds. Resolved serialization bugs for datasets with groups and added support for HDF5 Enumeration data types. Updated the HDF5 library version to 2.1.1 to address a critical security vulnerability found in 1.14.6.
• gen_dmrpp_side_car: Introduced a consolidated Python script to handle HDF4, HDF5/NetCDF4, and missing georeferencing data.
• Optimized Storage: Added the -L flag option to write variable-length data into a sidecar file if the main DMR++ file becomes too large. Stored CF grid-mapping 1-byte variables directly in the DMR++ instead of a sidecar file to improve response times.
• Robustness: Added support for HDF4 dmr++ generation even if HDF4 filename extensions are missing, and fixed building errors for complex datasets, including ECCOSTRESS L2, AIRS, and OMI.
• Vlen Data Storage: Added an option for users to opt to store variable-length (vlen) data inside a separate sidecar file.
• Fixed-Size String Arrays: Completed code cleanup to manage fixed-size string arrays without creating memory leaks. Switched memory allocation from reserve to resize to resolve specific Linux memory errors.
• Buffer Overflow Prevention: Fixed a potential buffer overflow vulnerability triggered when ingesting fixed-size string arrays.
• Array Subsetting & Dimensions: Added subsetting support for both variable-length and fixed-size string arrays when chunk size exceeds array size. Added mapping to treat 1-character string arrays as equivalent char arrays in netCDF.
• Size Calculation: Revised the calculations determining the maximum response size for string arrays.

DAP4

• Improved Large Variable Support: Enabled the DAP service to support DAP4 and NetCDF4 binary responses with individual variables larger than 2GB.
• Unlimited Dimensions: Added support for netCDF files containing variables with unlimited dimensions.

NASA (Performance and Cloud Optimizations)

• DMR++ Direct S3 Access: Replaced TEA redirects with pre-signed S3 URLs using TEA STS credentials. This was first applied to data requests and later expanded to initial DMR++ requests to dramatically lower response times.
• User Centric Caching: Included the user ID in the keys for data URL caches to prevent potential misattribution of data requests.
• Authentication Speed: Implemented local EDL token validation and direct user ID extraction from tokens to reduce curl request and session connection times.\
• AWS Warm Pool: Altered deployments to leverage an AWS Warm Pool for faster autoscaler response.
• Presigned DMR++ URLs: Implemented functionality to presign the DMR++ URL to avoid embedding request headers inside the presigned URL resource.
• User Centric Caching: Multi-tenant cache safety was enhanced by appending the user ID suffix to cache keys within both EffectiveURLCache and SignedURLCache.
• Error Messaging: Improved user-facing errors for situations where parsing S3/STS credentials fails.
• Token Cleanup: Completely eliminated deprecated echo-token support from the codebase.
• EDL (Earthdata Login) Instrumentation: Implemented profiling checkpoints and leaner CloudWatch metrics tracking for EDL token validation. It was optimized to skip optimization/logging overhead when no token is present and to use the token to fetch user IDs directly.
• Session Management: Improved session security by renewing sessions following authentication, supporting token revocation on logout, and parsing the X-Forwarded-For header to correctly track client IPs.
• UI Tweaks: Swapped out local interactive tutorials links for official NASA tutorial links, fixed DAP4 help.jsp banners, and temporarily added, then subsequently removed, a government shutdown banner.
• Checksums: Forced data checksum transmissions to be active at all times for the NGAP service to ensure consistency across separate requests.

Retirements

• Hyrax Gateway Service
• WCS Web Coverage Services (versions 1 and 2)
• w10n service
• Hyrax Administration Interface (HAI): The HAI has been retired, including associated web.xml references and admin logs.
• Build DMR++ Service. Unused service.

Downloads

Docker images are now the only binary release product for Hyrax. This is the simplest way to deploy Hyrax as it eliminates compatibility issues with your operating system and other software by creating a self-contained environment. You only need the Docker software itself, available for Mac, Windows, and Linux.

Hyrax on DockerHub

The Hyrax Data Server bundled in a Docker image.

• Use the tag latest to refer to the most recent official release image.
• If you want the release image for the Hyrax-1.18.0 specifically, or use the tag opendap/hyrax:1.18.0-0-el8 for the RHEL8 build and opendap/hyrax:1.18.0-1-el9 to refer to the RHEL9 build.
• Use the tag snapshot to refer to the most recent docker image built and tested by our CICD process. The snapshot version includes the latest commits to make their way through the CICD chain.

Example:

$ docker pull opendap/hyrax:1.18.0-0-el8