Preparing Host

Docker

Get access the Datavault Builder repository
- Provide us your Email address so you your account can be initiated and we can send you a prepared configuration file.
Install Docker & Docker Compose plugin
- https://docs.docker.com/engine/install/
- Verify docker version to be 20.10.13 or higher:
  docker version
- Verify docker compose version to be 2.3.3 or higher:
  docker compose version
Log into our repository and pull an image (once you have provided us your user and have been granted access):
```
docker login docker.datavault-builder.com
docker pull docker.datavault-builder.com/datavaultbuilder/api:8.8.1.0
```
Hint

If your host machine does not have direct access to our repository, you can as well download the images on another machine and copy them manually. Please check the section below regarding details.
Optional but recommended: verify the image signature. Every Datavault Builder image is signed with the same Sigstore cosign key used for the Installation Manager bootstrap script. Verify the key once — do this before trusting it for any image, since a key downloaded and used without this check proves nothing (a compromised or spoofed server could serve a matching fake key alongside a fake signature):
The current dvb-cosign.pub fingerprint (SHA-256 over the DER-encoded public key) is:
```
aca763ec83b9288515363650a29dcec0fead6eaa9de3c126be37c2db35df6d8b
```
This fingerprint is the trust anchor for the entire verification flow. As long as you fetched this documentation from docs.datavault-builder.com — a host served separately from install.datavault-builder.com — an attacker who compromises the install server alone cannot also forge it.

Note

Older Datavault Builder versions may have been signed with a previous key. If you are installing an older release, refer to that release’s documentation for the matching fingerprint.
1. One-time: install cosign on the machine that will run the verification (Linux amd64 example):
  curl -sSfLo cosign https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 chmod +x cosign sudo mv cosign /usr/local/bin/
  
  For other platforms see https://docs.sigstore.dev/cosign/installation/.
2. Download the public key and confirm its fingerprint matches the value shown above. A key downloaded and used without this check proves nothing — a compromised or spoofed server could serve a matching fake key alongside a fake signature:
  curl -fsSLO https://install.datavault-builder.com/dvb-cosign.pub openssl pkey -pubin -in dvb-cosign.pub -outform DER | openssl dgst -sha256
  
  Expected output:
  
  SHA2-256(stdin)= aca763ec83b9288515363650a29dcec0fead6eaa9de3c126be37c2db35df6d8b
  
  If the value does not match, stop — do not trust this key — and contact Datavault Builder support.
3. Optional: cross-check the key against our signed key statement, recorded in the public Sigstore Rekor transparency log. This confirms the key’s authenticity independently of trusting install.datavault-builder.com alone:
  curl -fsSLO https://install.datavault-builder.com/dvb-cosign-key-verification.txt curl -fsSLO https://install.datavault-builder.com/dvb-cosign-key-verification.sigstore.json cosign verify-blob \ --key dvb-cosign.pub \ --bundle dvb-cosign-key-verification.sigstore.json \ dvb-cosign-key-verification.txt
  
  Expected output: Verified OK. The bundle contains a Rekor inclusion proof, so this check works fully offline — no live call to the transparency log is required.
Once the key is verified, check each image against it. The example below verifies the core image; repeat this for every image you pull (core, connectionpool, api, webgui etc.), since each is signed and verified independently:
```
cosign verify --key dvb-cosign.pub docker.datavault-builder.com/datavaultbuilder/core:8.8.1.0
```
Successful verification prints The following checks were performed on each of these signatures followed by the verified payload as JSON. On failure, cosign exits non-zero — do not run the image, and contact Datavault Builder support.
Hint

Prefer pinning to a digest over a tag in production deployments — docker.datavault-builder.com/datavaultbuilder/core@sha256:<digest> — since tags are mutable and digests are not. Get the digest for the image you just verified with:
```
docker inspect --format='{{index .RepoDigests 0}}' docker.datavault-builder.com/datavaultbuilder/core:8.8.1.0
```
Optional: Run a hello-world sample:
- To check docker compose and docker are running properly, save the following file to a local folder to a file called docker-compose.yml:
  services: helloworld: image: 'hello-world'
- Switch using cmd or bash to the folder where you saved the docker-compose.yml and type:
  docker compose up
- You should get a message saying:
  helloworld | helloworld | Hello from Docker!

Note

If this doesn’t work check the following prerequisities

your computer is connected to the internet
if you use a proxy that the proxy is configured correctly
you have the latest version of Docker and Docker compose installed

Download of Container Images on Another Computer

You can pull the image on a computer that have access to the internet:
```
sudo docker pull hello-world
```

Then you can save this image to a file:

sudo docker save -o hello-world_image.docker hello-world

Transfer the file on the offline computer (USB/CD/…) and load the image from the file:
```
sudo docker load -i hello-world_image.docker
```

Note

For details about the commands

Kubernetes

Currently the documentation is based on docker compose.

Please reach out to us regarding HELM Charts.