Skip to main content

Images and tags

Pin explicit image tags in prod​

Never rely on :latest in prod — pin a specific tag matching the chart's appVersion:

# values-prod.yaml
openbox-backend:
  image:
    repository: ghcr.io/openbox-ai/openbox-backend
    tag: "0.1.0"                # explicit
    pullPolicy: IfNotPresent

openbox-core:
  image:
    tag: "0.1.0"

openbox-fe:
  image:
    tag: "0.1.0"

guardrails-api:
  image:
    tag: "0.1.0"

model-host-detect-pii:
  image:
    tag: "0.1.0"

model-host-nsfw:
  image:
    tag: "0.1.0"

model-host-toxicity:
  image:
    tag: "0.1.0"

Mirror to your private registry​

Set global.imageRegistry — the chart prefixes all sub-chart images with it:

global:
  imageRegistry: harbor.mycompany.internal
  # Chart will pull: harbor.mycompany.internal/openbox-ai/openbox-backend:0.1.0

Mirror images before install:

for img in openbox-backend openbox-core openbox-fe guardrails-api \
           model-host-detect-pii model-host-nsfw model-host-toxicity; do
  skopeo copy \
    docker://ghcr.io/openbox-ai/${img}:0.1.0 \
    docker://harbor.mycompany.internal/openbox-ai/${img}:0.1.0
done

Image pull secrets (private registry)​

If your registry requires auth:

kubectl create secret docker-registry harbor-pull-secret \
  --docker-server=harbor.mycompany.internal \
  --docker-username=<user> \
  --docker-password=<password> \
  --docker-email=<email> \
  -n openbox

Then in values:

global:
  imagePullSecrets:
    - harbor-pull-secret

Multi-arch (ARM64)​

All OpenBox images are published multi-arch (linux/amd64 + linux/arm64). Docker/Kubernetes auto-picks the matching arch. No values change needed for Graviton / Ampere nodes.

Verify​

kubectl get pods -n openbox -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | sort -u
# All images should show your registry prefix + pinned tag