Install Stella Ops

1 · Checklist before you begin

2 · Install with Docker Compose

1. 1

   Unpack the bundle

   Extract the release archive and change into it. release-manifest.yaml records the authoritative version — if it disagrees with the filename, trust the manifest.

2. 2

   Verify before you run

   Check the manifest signature with Cosign?Container signing tool from Sigstore project for signing and verifying container images and artifacts, then run tools/verify-bundle.py to check every file hash and image digest. The install scripts re-check the file checksums on every run and stop on any mismatch.

3. 3

   Run the installer

   ./install.sh (or .\install.ps1) verifies the bundle, generates every secret and certificate, pulls the images, starts the stack, and waits for it to converge. First start pulls several GB and runs migrations — ten to twenty minutes is normal.

4. 4

   Sign in

   Open https://127.0.0.1:8443/ and sign in as admin with the password the installer prints once — there is no default password. The gateway serves a self-signed certificate, so your browser warns once. Change the password after your first sign-in.

$ curl -fsSLO https://get.stella-ops.org/releases/v1.0.0-RC1/stellaops-bundle-v1.0.0-RC1.tar.gz
$ curl -fsSL https://get.stella-ops.org/releases/v1.0.0-RC1/SHA256SUMS \
    | sha256sum --check --ignore-missing
$ tar xzf stellaops-bundle-v1.0.0-RC1.tar.gz && cd stellaops-bundle-v1.0.0-RC1
$ cosign verify-blob --insecure-ignore-tlog=true --key release-signing.pub \
    --signature release-manifest.yaml.sig release-manifest.yaml
$ python tools/verify-bundle.py --require-signature --require-digests
$ ./install.sh
  Console    https://127.0.0.1:8443/
  Username   admin
  Password   <generated, shown once>

Prefer to run every step yourself? Copy .env.example to .env and replace every CHANGE_ME and GENERATED_ value — the stack refuses to start on a missing secret rather than falling back to a default. Then docker compose pull, docker compose up -d, and docker compose ps until every service reports healthy.

3 · Offline install (air-gap)

The stack makes no third-party network calls at startup — everything it needs is in the images and the bundle's config/ directory. To install without internet access:

1. 1

   Mirror the images

   On a connected host, mirror the image digests recorded in release-manifest.yaml into your internal registry, or docker save them to a tarball. docker-compose.pinned.yml pins every image by digest, so the deployment stays reproducible.

2. 2

   Transfer

   Move the verified bundle and the mirrored images to your air-gapped site via an approved medium (USB, courier, drop box).

3. 3

   Install against your registry

   Set STELLA_REGISTRY in .env to your internal registry and run ./install.sh --offline. Advisory and VEX data arrives separately as an Offline Kit — import it with stella offline import --bundle <kit>.tar.zst, or drop it into airgap-import/.

4 · Free-tier limits

The licence permits evaluation, development and testing freely, and production use within 3 environments and 100 new-digest scans in any rolling 24-hour period. The same build is used at every tier — nothing is gated behind a different binary.

Beyond those limits a commercial licence is required — see pricing. Limits are terms of the licence, not runtime restrictions in the software.

5 · Connect your CI

Your pipeline can produce evidence before any deployment target is connected. stella ci init generates a workflow for GitHub, GitLab, or Gitea; each build then scans the image and signs a build attestation (DSSE?Dead Simple Signing Envelope - a simple, flexible standard for signing arbitrary data with cryptographic signatures). No deployment connector is required.

$ stella ci init --platform github --mode scan-attest
✓ Created: .github/workflows/stellaops-gate.yml

✓ 1 template(s) initialized successfully

Next steps:
  1. Review the generated workflow files
  2. Add required secrets (STELLAOPS_TOKEN, etc.)
  3. Commit and push to trigger the workflow

6 · Artifacts and verification

Where artifacts come from today, and how to verify them before you trust them.

Verify before first run: import the Cosign?Container signing tool from Sigstore project for signing and verifying container images and artifacts/PGP public keys and check each artifact's signature and manifest — connected or air-gapped. Verification keys →

For procurement review, use License and Pricing as the canonical entitlement and licensing references.

7 · Your first verified promotion

A fresh install has no environments and no releases in it. These four steps take one container image from registered to promoted, and end with the decision exported as a single signed evidence card.

1. 1

   Create your environments

   Define the promotion path — dev, staging, production — and attach a policy to each. Console only today; there is no CLI command for this step yet.

2. 2

   Register a digest release

   Add a container image by its content digest. Stella scans it and generates an SBOM?Software Bill of Materials - a complete list of all packages and dependencies in your software. Console only today; there is no CLI command for this step yet.

3. 3

   Submit the promotion

   Ask Stella to move the release to the next environment. The command submits the decision — the gate result, and any approvals still needed, appear in the Console.

4. 4

   Export the evidence card

   Package a sealed evidence pack as one signed file. Without --output it is written as <pack-id>.evidence-card.json.

$ stella release promote rel-7829726 --to staging
$ stella evidence card export evp-2026-01-14-abc123 --output evidence-card.json

Both arguments are opaque identifiers the product generates: a release ID looks like rel-7829726, an evidence pack ID like evp-2026-01-14-abc123. A release name or version will not resolve. Read both from the Console — no CLI command lists releases yet.