Container image & supply chain

Edition: this page applies to the Enterprise Edition runtime, which ships as a signed container image. The Developer Edition is a local Python process (pipx install stratabi) and needs none of this.

StrataBI Enterprise runs as a container in your AWS account. The image is built from a parameterized Dockerfile that defaults to public registries but can pull its base image and Python packages from your own registry and index — important for regulated or air-gapped environments. You build the image; the deployment just consumes the resulting image URL (stratabi_image).

Defaults: public

With no configuration, the build uses the public python base image and PyPI:

bash

docker build -t your-registry/stratabi:1.0 .

Public base images and third-party Python packages are provided by their respective upstreams as is. When you build from public defaults, that supply chain is your responsibility; when you bring private repositories, it is entirely yours. See the license terms.

Private base image and package index

Override the build-args to source the base image and packages from your own registry/index (Harbor, Artifactory, Nexus, …):

bash

docker build \
  --build-arg BASE_IMAGE=harbor.example.com/library/python:3.11-slim \
  --build-arg PIP_INDEX_URL=https://artifactory.example.com/api/pypi/pypi/simple \
  --build-arg PIP_EXTRA_INDEX_URL=https://artifactory.example.com/api/pypi/internal/simple \
  -t your-registry/stratabi:1.0 .

A build.sh wrapper reads the same values from BASE_IMAGE / PIP_INDEX_URL / etc. environment variables if you prefer.

Credentials (never in a layer)

Authenticate the base image pull with your builder's docker login (outside the Dockerfile). For a private index, pass credentials as a BuildKit secret — never a build-arg, which would persist in image history:

bash

docker build --secret id=pip_conf,src=./pip.conf  ...    # pip.conf holds index URL + auth

Internal certificate authorities

If your registry/index presents an internal CA, drop the CA bundle(s) as *.crt into ./certs/ before building. The Dockerfile installs and trusts them; if the directory is empty, the step is skipped. (mTLS, proxies, and other registry-specific setups may need additional handling — treat those as advanced/air-gapped cases.)

Bring your own image

For the strictest environments you can build the image entirely yourself and pass its URL to the deployment via stratabi_image. The compatibility contract is small: the image must run python -m stratabi.app, expose port 8050, and contain the StrataBI runtime plus its Python dependencies. The provided Dockerfile is the reference.

Enterprise runtime: account-entitled

The StrataBI Enterprise runtime is distributed as an account-entitled, signed artifact, not as source you build from. You fetch it with StrataCTL, which checks your account's entitlement, downloads the artifact, and verifies its signature:

bash

stratactl fetch-runtime --version 1.0.0      # writes ./dist/<runtime>.whl (verified)
docker build --build-arg RUNTIME_WHEEL=dist/<runtime>.whl -t your-registry/stratabi:1.0.0 .

Because the build requires a valid account entitlement to obtain the runtime, deploying outside your licensed scope is discouraged at this seam, and the boot-time entitlement check enforces it at runtime. Air-gapped: the signed, account-scoped artifact is delivered out of band and validated against an offline license token — no build-time network call.

The Developer Edition is source-available and is not gated this way; the entitlement check applies only to the Enterprise runtime artifact.

To build and scan this image entirely in your own CI/CD and point the install at it, see Bring your own CI/CD (Option A). The companion stratactl fetch-bundle retrieves the signed OpenTofu bundle the same way for teams that also run the deploy themselves.

Build in your account with CodeBuild (reference template)

If you'd rather not build the image on a workstation, a reference Terraform template (build_template) stands up an AWS CodeBuild pipeline in your account that builds the image from the entitled wheel using a public base image and pushes it to ECR. It's a starting point you own and customize — StrataCI runs your infrastructure but never your Docker builds.

bash

# 1. fetch the entitled wheel and stage it in S3
stratactl fetch-runtime --version 1.0.0
aws s3 cp ./dist/stratabi_runtime-1.0.0-py3-none-any.whl \
  s3://<your-bucket>/runtime/stratabi_runtime-1.0.0-py3-none-any.whl

# 2. stand up + run the build pipeline
cd build_template && terraform init
terraform apply -var wheel_bucket=<your-bucket> \
  -var wheel_key=runtime/stratabi_runtime-1.0.0-py3-none-any.whl -var image_tag=1.0.0
aws codebuild start-build --project-name "$(terraform output -raw codebuild_project)"
terraform output -raw image_uri      # feed this to the deployment as stratabi_image

Swap the base_image variable to pull from a private/air-gapped registry.

Artifact source resolution

For the Enterprise runtime, StrataCTL resolves where to fetch the entitled artifact from its configuration. In restricted or air-gapped environments you can pin this explicitly — set the artifact source via flag, environment variable, config file, or SSM, and that value always takes precedence. Developer Edition installs are unaffected: they resolve from a public URL, your own S3, or the conventional bucket key, and never contact StrataHQ.