Container Registry

BitDrip Docker images are distributed via GitHub Container Registry (GHCR) at ghcr.io/getbitdrip/. All images are signed with cosign via Sigstore for supply chain integrity.

Public image access

BitDrip production images are public and pull anonymously. No GHCR credentials are required or distributed to customers. A valid BitDrip license and current entitlement are still required when the services start; public image transport does not bypass product licensing, deployment limits, or restricted-mode enforcement.

Available Images

Image	Tag	Description
ghcr.io/getbitdrip/policy-engine	2.2.0, latest	Policy Engine + native license validator
ghcr.io/getbitdrip/dashboard	2.2.0, latest	Dashboard (nginx-served React SPA)

Note: The Proxy Daemon runs as a local process on end-user machines and is distributed via the installer bundle — it is not published as a Docker image.

Always pin to a specific version tag in production. The latest tag is updated on every release and may introduce breaking changes.

Verifying Image Signatures

All images are signed with cosign using GitHub Actions OIDC (keyless signing via Sigstore). Verify before pulling to production:

# Install cosign if not already installed
# https://docs.sigstore.dev/cosign/system_config/installation/

# Verify policy-engine image
cosign verify ghcr.io/getbitdrip/policy-engine:2.2.0 \
  --certificate-identity-regexp="https://github.com/getbitdrip/BitDrip-app/.github/workflows/release.yml@refs/tags/v.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"

# Verify dashboard image
cosign verify ghcr.io/getbitdrip/dashboard:2.2.0 \
  --certificate-identity-regexp="https://github.com/getbitdrip/BitDrip-app/.github/workflows/release.yml@refs/tags/v.*" \
  --certificate-oidc-issuer="https://token.actions.githubusercontent.com"

A successful verification outputs the signing certificate details and exits 0. Reject any image that fails verification.

Enforcing Verification in CI/CD

Add cosign verification as a step before any docker pull or kubectl apply:

# GitHub Actions example
- name: Verify BitDrip image signatures
  run: |
    cosign verify ghcr.io/getbitdrip/policy-engine:${{ env.BITDRIP_VERSION }} \
      --certificate-identity-regexp="https://github.com/getbitdrip/BitDrip-app/.github/workflows/release.yml@refs/tags/v.*" \
      --certificate-oidc-issuer="https://token.actions.githubusercontent.com"

Pulling Images

# Pull both server-side services
docker pull ghcr.io/getbitdrip/policy-engine:2.2.0
docker pull ghcr.io/getbitdrip/dashboard:2.2.0

Air-Gapped Installations

For environments without outbound internet access, transfer images to your private registry:

Export from GHCR

On a machine with internet access, pull the public GHCR images anonymously:

VERSION=2.2.0
IMAGES=(policy-engine dashboard)

for img in "${IMAGES[@]}"; do
  # Verify signature before exporting
  cosign verify "ghcr.io/getbitdrip/${img}:${VERSION}" \
    --certificate-identity-regexp="https://github.com/getbitdrip/BitDrip-app/.github/workflows/release.yml@refs/tags/v.*" \
    --certificate-oidc-issuer="https://token.actions.githubusercontent.com"

  docker pull "ghcr.io/getbitdrip/${img}:${VERSION}"
  docker save "ghcr.io/getbitdrip/${img}:${VERSION}" \
    -o "bitdrip-${img}-${VERSION}.tar"
done

# Bundle them
tar -czf bitdrip-images-${VERSION}.tar.gz bitdrip-*.tar

Import into Air-Gapped Environment

VERSION=2.2.0
tar -xzf bitdrip-images-${VERSION}.tar.gz

# Load each image
docker load -i bitdrip-policy-engine-${VERSION}.tar
docker load -i bitdrip-dashboard-${VERSION}.tar

# Retag for your private registry
REGISTRY=registry.internal.example.com
for img in policy-engine dashboard; do
  docker tag "ghcr.io/getbitdrip/${img}:${VERSION}" \
    "${REGISTRY}/bitdrip/${img}:${VERSION}"
  docker push "${REGISTRY}/bitdrip/${img}:${VERSION}"
done

Update your docker-compose.yml to reference the internal registry:

services:
  policy-engine:
    image: registry.internal.example.com/bitdrip/policy-engine:2.2.0
  dashboard:
    image: registry.internal.example.com/bitdrip/dashboard:2.2.0

SBOM (Software Bill of Materials)

Every release includes a CycloneDX SBOM attached as a cosign attestation. Download it to inspect all dependencies included in an image:

cosign download attestation ghcr.io/getbitdrip/policy-engine:2.2.0 \
  | jq -r '.payload' \
  | base64 -d \
  | jq '.predicate'

The SBOM lists all npm packages and their versions for supply chain auditing and vulnerability tracking.

Subscribing to Security Advisories

Subscribe to GitHub security advisories to receive notifications when new patches are released. When a security release ships:

1. Pull the new image and verify its cosign signature
2. Update your deployment to the new tag
3. Perform a rolling restart
4. Confirm /health returns 200 before removing old containers