Docker & Compose Deployment Guide
Audience: operators and release engineers deploying Stella Ops onto Docker Compose hosts. Scope: the supported packaging path (Docker Compose, Offline Kit, signed release manifests) and the evidence each deployment must produce.
This guide describes how Stella Ops — the self-hosted DevOps vulnerability-scanner and release control plane — is deployed onto non-Kubernetes container estates.
Supported scope
Stella Ops deployment packaging targets Docker Compose, the Offline Kit, and signed release manifests. Kubernetes and Helm are explicitly out of scope; see Unsupported legacy paths below.
Compose deployment flow
- Select the release channel and signed release manifest.
- Verify image digests with the release checker before deployment.
- Mirror required images into the approved local registry for offline or sealed environments.
- Configure environment variables through Compose environment files or the approved host secret store.
- Start the supported Compose profile for the environment.
- Run service health checks and record results in release evidence.
- Keep rollback material limited to previous signed manifests, previous Compose configuration, and preserved data backups.
For the full promote/upgrade/rollback procedure (digest pinning, manifest validation, migration gating), see the Deployment upgrade & rollback runbook. For Aggregation-Only Contract (AOC) deployment specifics, see Container deployment guide — AOC.
Evidence requirements
- Release manifest path and SHA-256.
- Image references in
repository@sha256:<digest>form. - Compose config hash.
- Health-check output.
- Operator approval and rollback decision.
Unsupported legacy paths
Do not use Helm values, Helm template output, Helm upgrades, Kubernetes pods, Kubernetes port-forwarding, Kubernetes Secrets, or kubectl commands as Stella Ops deployment evidence.