Container Registry

BitDrip Docker images are distributed via GitHub Container Registry (GHCR) at ghcr.io/getbitdrip/. All images are signed with cosign via Sigstore for supply chain integrity.

Authenticating with GHCR

Your BitDrip license includes a personal registry token. Retrieve it from the customer portal:

# 1. Get your deploy token from the portal
curl -s -H "X-License-Token: <your-license-jwt>" \
  https://portal.bitdrip.app/api/ghcr-token
# Returns: { "token": "ghp_...", "username": "bitdrip-deploy" }

# 2. Log in to GHCR
echo "$TOKEN" | docker login ghcr.io \
  -u bitdrip-deploy \
  --password-stdin

The token is scoped read-only to the BitDrip package namespace. It cannot push images or access other repositories.

Available Images

Image	Tag	Description
ghcr.io/getbitdrip/policy-engine	2.2.0, latest	Policy Engine + native license validator
ghcr.io/getbitdrip/dashboard	2.2.0, latest	Dashboard (nginx-served React SPA)

Note: The Proxy Daemon runs as a local process on end-user machines and is distributed via the installer bundle — it is not published as a Docker image.

Always pin to a specific version tag in production. The latest tag is updated on every release and may introduce breaking changes.

Verifying Image Signatures

All images are signed with cosign using GitHub Actions OIDC (keyless signing via Sigstore). Verify before pulling to production:

# Install cosign if not already installed
# https://docs.sigstore.dev/cosign/system_config/installation/

# Verify policy-engine image
cosign verify ghcr.io/getbitdrip/policy-engine:2.2.0 \
  --certificate-identity-regexp="https://github.com/getbitdrip/BitDrip-app/.github/workflows/release.yml@refs/tags/v.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"

# Verify dashboard image
cosign verify ghcr.io/getbitdrip/dashboard:2.2.0 \
  --certificate-identity-regexp="https://github.com/getbitdrip/BitDrip-app/.github/workflows/release.yml@refs/tags/v.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"

A successful verification outputs the signing certificate details and exits 0. Reject any image that fails verification.

Enforcing Verification in CI/CD

Add cosign verification as a step before any docker pull or kubectl apply:

# GitHub Actions example
- name: Verify BitDrip image signatures
  run: |
    cosign verify ghcr.io/getbitdrip/policy-engine:${{ env.BITDRIP_VERSION }} \
      --certificate-identity-regexp="https://github.com/getbitdrip/BitDrip-app/.github/workflows/release.yml@refs/tags/v.*" \
      --certificate-oidc-issuer="https://token.actions.githubusercontent.com"

Pulling Images

# Pull both server-side services
docker pull ghcr.io/getbitdrip/policy-engine:2.2.0
docker pull ghcr.io/getbitdrip/dashboard:2.2.0

Air-Gapped Installations

For environments without outbound internet access, transfer images to your private registry:

Export from GHCR

On a machine with internet access and GHCR authentication:

VERSION=2.2.0
IMAGES=(policy-engine dashboard)

for img in "${IMAGES[@]}"; do
  # Verify signature before exporting
  cosign verify "ghcr.io/getbitdrip/${img}:${VERSION}" \
    --certificate-identity-regexp="https://github.com/getbitdrip/BitDrip-app/.github/workflows/release.yml@refs/tags/v.*" \
    --certificate-oidc-issuer="https://token.actions.githubusercontent.com"

  docker pull "ghcr.io/getbitdrip/${img}:${VERSION}"
  docker save "ghcr.io/getbitdrip/${img}:${VERSION}" \
    -o "bitdrip-${img}-${VERSION}.tar"
done

# Bundle them
tar -czf bitdrip-images-${VERSION}.tar.gz bitdrip-*.tar

Import into Air-Gapped Environment

VERSION=2.2.0
tar -xzf bitdrip-images-${VERSION}.tar.gz

# Load each image
docker load -i bitdrip-policy-engine-${VERSION}.tar
docker load -i bitdrip-dashboard-${VERSION}.tar

# Retag for your private registry
REGISTRY=registry.internal.example.com
for img in policy-engine dashboard; do
  docker tag "ghcr.io/getbitdrip/${img}:${VERSION}" \
    "${REGISTRY}/bitdrip/${img}:${VERSION}"
  docker push "${REGISTRY}/bitdrip/${img}:${VERSION}"
done

Update your docker-compose.yml to reference the internal registry:

services:
  policy-engine:
    image: registry.internal.example.com/bitdrip/policy-engine:2.2.0
  dashboard:
    image: registry.internal.example.com/bitdrip/dashboard:2.2.0

SBOM (Software Bill of Materials)

Every release includes a CycloneDX SBOM attached as a cosign attestation. Download it to inspect all dependencies included in an image:

cosign download attestation ghcr.io/getbitdrip/policy-engine:2.2.0 \
  | jq -r '.payload' \
  | base64 -d \
  | jq '.predicate'

The SBOM lists all npm packages and their versions for supply chain auditing and vulnerability tracking.

Subscribing to Security Advisories

Subscribe to GitHub security advisories to receive notifications when new patches are released. When a security release ships:

1. Pull the new image and verify its cosign signature
2. Update your deployment to the new tag
3. Perform a rolling restart
4. Confirm /health returns 200 before removing old containers