Container images & license posture

There is one artifact per application. Which features you get is decided by your license, not by which image you pulled.

This changed in 1.7.0

Earlier releases split the product into a public Community Edition image and private Enterprise -ee images, and upgrading meant re-imaging. That split is gone. There is no Community Edition, no -ee image, and no registry credential needed to run DVARA. If you are following an older guide, this page supersedes it.

The images

Image	Port	Access
ghcr.io/dvarahq/dvara-gateway	:8080	Public — no login
ghcr.io/dvarahq/dvara-flightdeck	:8090	Public — no login
ghcr.io/dvarahq/dvara-flightdeck-saas	:8090	Private — managed service only

docker pull ghcr.io/dvarahq/dvara-gateway:1.7.0      # data plane
docker pull ghcr.io/dvarahq/dvara-flightdeck:1.7.0   # console + portal

Helm chart: oci://ghcr.io/dvarahq/charts/dvara:1.7.0. PostgreSQL is required.

dvara-flightdeck-saas is the only private image. It carries the self-service signup and Stripe billing surface used by the hosted service, and self-hosted installs neither need nor want it. If you are running DVARA yourself, you never pull it and you need no registry credential at all.

Two retired images still exist in the registry

dvara-mcp-gateway and dvara-a2a-gateway were retired — the MCP and A2A planes now run inside the gateway process, and ports 8070 and 8075 no longer exist. Those packages still carry an old latest tag from a pre-release build. Do not pull them. Anything addressing :8070 or :8075 should address the gateway on :8080.

The gateway was also renamed from dvara-llm-gateway. The old name is not updated.

The two postures

A DVARA install reports its posture on GET /actuator/gateway-status as posture:

Posture	When	What you get
DEVELOPMENT	No valid license	The complete product except the MCP and A2A planes
PRODUCTION	Valid license applied	Everything, plus production rights and support

DEVELOPMENT is not a crippled tier. It runs the full policy engine, the full HMAC-signed tamper-evident audit chain, the complete PII pipeline, guardrails, real cost calculation, budgets, SSO, RBAC and every routing strategy. Nothing is scaled down and nothing is a preview.

What a license adds:

• The MCP plane — governed Model Context Protocol tool calls.
• The A2A plane — governed agent-to-agent traffic.
• Production rights and support.

Nothing hard-fails without a license. An unlicensed install boots and serves; the two proxy planes simply do not activate.

Applying a license

Set dvara.license.key (DVARA_LICENSE_KEY) to the signed DVARA-… envelope, or enter it once in the Console at /license, where it is stored and distributed to your data-plane pods on the signed config bundle.

docker run -e DVARA_LICENSE_KEY="DVARA-…" ghcr.io/dvarahq/dvara-gateway:1.7.0

Development → Production needs a restart

The license is read at startup to decide which planes to wire, so applying one to a running unlicensed instance does not activate the MCP or A2A planes until it restarts.

Renewing an existing license — swapping one valid key for another on an already-licensed instance — does not need a restart; the next license check picks it up.

Upgrading from an unlicensed install

It is a key-swap and a restart, not a re-image. You are already running the right image.

1. Set DVARA_LICENSE_KEY (or enter the license in the Console at /license).
2. Restart.

Your data and configuration in PostgreSQL carry over untouched. If you are coming from a pre-1.7.0 install that used the -ee images, repoint to dvara-gateway / dvara-flightdeck and drop the pull secret — it is no longer needed.

Kubernetes

No imagePullSecret is required for a self-hosted install, because both images are public:

helm install dvara oci://ghcr.io/dvarahq/charts/dvara --version 1.7.0 \
  -n dvara --create-namespace

See Kubernetes for the full values reference.

Air-gapped

Runtime is fully offline — license validation is local and there is no phone-home. Pull on a connected host, transfer, load:

docker save ghcr.io/dvarahq/dvara-gateway:1.7.0 \
            ghcr.io/dvarahq/dvara-flightdeck:1.7.0 -o dvara-1.7.0.tar
# move dvara-1.7.0.tar to the air-gapped host …
docker load -i dvara-1.7.0.tar

On an air-gapped install, supply the license through DVARA_LICENSE_KEY rather than the Console.