Container image & supply chain

Edition: this page applies to the Enterprise Edition runtime, which ships as a signed container image. The Developer Edition is a local Python process (pipx install stratabi) and needs none of this.

StrataBI Enterprise runs as a container in your AWS account. The image is built from a parameterized Dockerfile that defaults to public registries but can pull its base image and Python packages from your own registry and index — important for regulated or air-gapped environments. You build the image; the deployment just consumes the resulting image URL (stratabi_image).

Defaults: public

With no configuration, the build uses the public python base image and PyPI:

bash

docker build -t your-registry/stratabi:1.0 .

Public base images and third-party Python packages are provided by their respective upstreams as is. When you build from public defaults, that supply chain is your responsibility; when you bring private repositories, it is entirely yours. See the license terms.

Private base image and package index

Override the build-args to source the base image and packages from your own registry/index (Harbor, Artifactory, Nexus, …):

bash

docker build \
  --build-arg BASE_IMAGE=harbor.example.com/library/python:3.11-slim \
  --build-arg PIP_INDEX_URL=https://artifactory.example.com/api/pypi/pypi/simple \
  --build-arg PIP_EXTRA_INDEX_URL=https://artifactory.example.com/api/pypi/internal/simple \
  -t your-registry/stratabi:1.0 .

A build.sh wrapper reads the same values from BASE_IMAGE / PIP_INDEX_URL / etc. environment variables if you prefer.

Credentials (never in a layer)

Authenticate the base image pull with your builder's docker login (outside the Dockerfile). For a private index, pass credentials as a BuildKit secret — never a build-arg, which would persist in image history:

bash

docker build --secret id=pip_conf,src=./pip.conf  ...    # pip.conf holds index URL + auth

Internal certificate authorities

If your registry/index presents an internal CA, drop the CA bundle(s) as *.crt into ./certs/ before building. The Dockerfile installs and trusts them; if the directory is empty, the step is skipped. (mTLS, proxies, and other registry-specific setups may need additional handling — treat those as advanced/air-gapped cases.)

Bring your own image

For the strictest environments you can build the image entirely yourself and pass its URL to the deployment via stratabi_image. The compatibility contract is small: the image must run python -m stratabi.app, expose port 8050, and contain the StrataBI runtime plus its Python dependencies. The provided Dockerfile is the reference.

Enterprise runtime: account-entitled

The StrataBI Enterprise runtime is distributed as an account-entitled, signed artifact, not as source you build from. You fetch it with StrataCTL, which checks your account's entitlement, downloads the artifact, and verifies its signature:

bash

stratactl fetch-runtime --version 1.0.0      # writes ./dist/<runtime>.whl (verified)
docker build --build-arg RUNTIME_WHEEL=dist/<runtime>.whl -t your-registry/stratabi:1.0.0 .

Because the build requires a valid account entitlement to obtain the runtime, deploying outside your licensed scope is discouraged at this seam, and the boot-time entitlement check enforces it at runtime. Air-gapped: the signed, account-scoped artifact is delivered out of band and validated against an offline license token — no build-time network call.

The Developer Edition is source-available and is not gated this way; the entitlement check applies only to the Enterprise runtime artifact.

Build in your account with CodeBuild (reference template)

If you'd rather not build the image on a workstation, a reference Terraform template (build_template) stands up an AWS CodeBuild pipeline in your account that builds the image from the entitled wheel using a public base image and pushes it to ECR. It's a starting point you own and customize — StrataCI runs your infrastructure but never your Docker builds.

bash

# 1. fetch the entitled wheel and stage it in S3
stratactl fetch-runtime --version 1.0.0
aws s3 cp ./dist/stratabi_runtime-1.0.0-py3-none-any.whl \
  s3://<your-bucket>/runtime/stratabi_runtime-1.0.0-py3-none-any.whl

# 2. stand up + run the build pipeline
cd build_template && terraform init
terraform apply -var wheel_bucket=<your-bucket> \
  -var wheel_key=runtime/stratabi_runtime-1.0.0-py3-none-any.whl -var image_tag=1.0.0
aws codebuild start-build --project-name "$(terraform output -raw codebuild_project)"
terraform output -raw image_uri      # feed this to the deployment as stratabi_image

Swap the base_image variable to pull from a private/air-gapped registry.

Artifact source resolution

For the Enterprise runtime, StrataCTL resolves where to fetch the entitled artifact from its configuration. In restricted or air-gapped environments you can pin this explicitly — set the artifact source via flag, environment variable, config file, or SSM, and that value always takes precedence. Developer Edition installs are unaffected: they resolve from a public URL, your own S3, or the conventional bucket key, and never contact StrataHQ.