Point paid images at ACR; correct signing, SBOM and tag claims The paid line now publishes to a private Azure Container Registry rather than GHCR, which could only share private packages with organisation members. Subscribers are issued a pull-only registry token and need no GitHub, Microsoft or Azure account. Also corrects claims that had gone stale in both directions: - Signing, SBOM and build provenance were described as 'in the pipeline' on three pages while two others already advertised them as shipped. They are live on both lines and verifiable; the tables now say so consistently. - The tag table documented a scheme (3.8.1, 3.8-stable) that no build has ever published. Replaced with the tags that actually exist. - runtime-studio is versioned on Elsa Studio, not the engine, so its tag differs from server and combined. This was undocumented and is an easy way to write a manifest that cannot be pulled. - Troubleshooting still told subscribers to log in to ghcr.io with a read:packages token and described access as following team membership. Every image reference on every page was checked against the live registries.
Read-only root and offline startup are now supported Documents behaviour that changed in the images published today. - readOnlyRootFilesystem works. Mount /data (SQLite only), /var/lib/valence-runtime and a tmpfs at /tmp, and the root filesystem can be read-only. Package directories may be mounted :ro. - Offline and air-gapped startup works, via a mounted package directory holding the full transitive closure of the packages you use. - Writable paths are documented, including the one that is easy to get wrong: HOME lives on /var/lib/valence-runtime, so the Data Protection key ring is there too, and an emptyDir signs users out on every rollout. - Kubernetes manifest gains a securityContext with fsGroup 1654. Without it a non-root container cannot write to its own root-owned volumes. BREAKING, and the reason for the new Release Notes page: the default SQLite path moved from elsa.db (relative to /app) to /data/elsa.db. Anyone relying on that default while mounting a volume at /app must move the mount; the page carries migration commands and an escape hatch. Automatic package reconciliation now ships off, so package changes follow your deploy schedule rather than a timer.