Editions & container images

DVARA is one product with two editions. Which edition you run is decided by the image you pull and the license you apply — two independent gates:

Gate	Controls	Mechanism
Registry access	Whether you can pull the Enterprise image	The Enterprise images are private — you need a credential we issue
License	Whether Enterprise features run	dvara.license.key — validated at runtime, on every image

Both matter. The public Community Edition image contains zero Enterprise bytecode, so making the Enterprise image private actually protects the intellectual property. And a private Enterprise image still refuses to run Enterprise features without a valid license — the registry gate is defense-in-depth, not a replacement for the license.

Community Edition — public, free, no login

The public images are the slim Community Edition: the full LLM gateway plus the CE governance teasers (deny-list policy, regex PII detection, local audit log, read-only cost estimate). They contain no Enterprise engine bytecode. Anyone can pull them, no authentication:

docker pull ghcr.io/dvarahq/dvara-llm-gateway:1.5.0     # data plane  (:8080)
docker pull ghcr.io/dvarahq/dvara-flightdeck:1.5.0      # console     (:8090)

Run them with no license key and they boot Community Edition. Postgres is required for every edition. This is the frictionless quickstart path — see Docker Compose.

Enterprise Edition — private, credential required

The Enterprise images carry the full Enterprise engines (policy DSL, HMAC-signed audit, FinOps/budgets, advanced routing, semantic cache, SSO/mTLS/vault) and the Enterprise console surfaces. They are private packages — pull them with the credential we issue you:

Image	What it is
ghcr.io/dvarahq/dvara-llm-gateway-ee	Full Enterprise data plane (:8080)
ghcr.io/dvarahq/dvara-flightdeck-ee	Full Enterprise console (:8090)
ghcr.io/dvarahq/dvara-mcp-gateway	MCP proxy (:8070) — Enterprise-only, no CE tier
ghcr.io/dvarahq/dvara-a2a-gateway	A2A proxy (:8075) — Enterprise-only, no CE tier

The MCP and A2A proxies have no Community tier — they require a license and are always private.

Authenticate, then pull

We issue each customer a dedicated registry username and token (you do not need a GitHub account of your own). Log in and pull:

echo "$DVARA_REGISTRY_TOKEN" | docker login ghcr.io -u "$DVARA_REGISTRY_USER" --password-stdin
docker pull ghcr.io/dvarahq/dvara-llm-gateway-ee:1.5.0
docker pull ghcr.io/dvarahq/dvara-flightdeck-ee:1.5.0

Kubernetes — imagePullSecret

Create a docker-registry secret from the issued credential and hand it to the Helm chart's global.imagePullSecrets:

kubectl -n dvara create secret docker-registry dvara-ghcr \
  --docker-server=ghcr.io \
  --docker-username="$DVARA_REGISTRY_USER" \
  --docker-password="$DVARA_REGISTRY_TOKEN"

helm install dvara oci://ghcr.io/dvarahq/charts/dvara --version 1.5.0 \
  --set-json 'global.imagePullSecrets=[{"name":"dvara-ghcr"}]' \
  --set gatewayServer.image.repository=ghcr.io/dvarahq/dvara-llm-gateway-ee \
  --set flightdeck.image.repository=ghcr.io/dvarahq/dvara-flightdeck-ee

The chart wires the pull secret into every deployment. See Kubernetes for the full values reference.

Air-gapped

Pull once on a connected host, transfer the tarball, and load on the air-gapped host — runtime is fully offline (local license validation, no phone-home):

docker save ghcr.io/dvarahq/dvara-llm-gateway-ee:1.5.0 \
            ghcr.io/dvarahq/dvara-flightdeck-ee:1.5.0 -o dvara-ee.tar
# move dvara-ee.tar to the air-gapped host …
docker load -i dvara-ee.tar

Upgrading Community → Enterprise

Since 1.5.0 the CE→EE upgrade is a re-image, not a key-swap — the public and Enterprise builds are different images. To upgrade:

1. Get your Enterprise registry credential (issued with your license).
2. Repoint your deployment from dvara-llm-gateway / dvara-flightdeck to the -ee images and add the pull secret (as above).
3. Set dvara.license.key (DVARA_LICENSE_KEY) to your signed license.

Your data and configuration in Postgres carry over unchanged — only the image and the license change.

Image reference

Edition	Data plane	Console	Access
Community	dvara-llm-gateway	dvara-flightdeck	Public — no login
Enterprise	dvara-llm-gateway-ee	dvara-flightdeck-ee	Private — credential required
Enterprise-only planes	dvara-mcp-gateway, dvara-a2a-gateway	—	Private — credential required

All under ghcr.io/dvarahq/. Helm chart: oci://ghcr.io/dvarahq/charts/dvara.