Docker Images

inboard publishes two Docker images to the GitHub Container Registry.

Concourse

ghcr.io/inboard-ai/concourse:latest

Property	Value
Base image	debian:bookworm-slim
User	concourse (non-root)
Port	8080
Config mount	/etc/concourse/config.yaml
Data volume	/data (SQLite databases)
Health check	curl -f http://localhost:8080/health
Included libraries	libxml2, libxmlsec1 (for SAML support)

Volumes

Path	Purpose	Mount type
/data	Primary and audit SQLite databases	Named volume (persistent)
/etc/concourse/config.yaml	Configuration file	Bind mount (read-only)

Tags

Tag	Description
latest	Most recent stable release
x.y.z	Specific version (e.g., 0.1.0)

Example

docker run -d --name concourse \
  -p 8080:8080 \
  -v concourse-data:/data \
  -v ./config.yaml:/etc/concourse/config.yaml:ro \
  -e CONCOURSE_JWT_SECRET=your-secret-at-least-32-bytes-long \
  ghcr.io/inboard-ai/concourse:latest

Relay

ghcr.io/inboard-ai/relay:latest

Property	Value
Base image	debian:bookworm-slim
User	relay (non-root)
Exposed ports	None (outbound connections only)
Config mount	/etc/inboard-relay/config.yaml

Volumes

Path	Purpose	Mount type
/etc/inboard-relay/config.yaml	Relay configuration with connection definitions	Bind mount (read-only)

Tags

Tag	Description
latest	Most recent stable release
x.y.z	Specific version (e.g., 0.1.0)

Example

docker run -d --name relay \
  -v ./relay.yaml:/etc/inboard-relay/config.yaml:ro \
  -e CONCOURSE_URL=https://your-concourse.example.com \
  -e RELAY_TOKEN=rl_xxx \
  ghcr.io/inboard-ai/relay:latest

Security

Both images follow container security best practices:

• Non-root user. Each image runs as a dedicated non-root user (concourse or relay).
• Minimal base image. Built on debian:bookworm-slim to reduce attack surface.
• No SSH. Neither image includes an SSH server.
• Read-only config. Mount configuration files as read-only (:ro).

Pulling images

Authenticate with the GitHub Container Registry if the images are private:

echo $GITHUB_TOKEN | docker login ghcr.io -u USERNAME --password-stdin

Pull a specific version:

docker pull ghcr.io/inboard-ai/concourse:0.1.0
docker pull ghcr.io/inboard-ai/relay:0.1.0