Trestle
Deployment boundary

Containers

CP22 does not publish an official container image. Verified release binaries are the available distribution format.

If you build your own image

  • Use the verified release binary and record its checksum.
  • Run as a non-root user with a persistent volume for TRESTLE_DATA_DIR.
  • Never place SQLite on a shared or network filesystem.
  • Expose Trestle only to the intended proxy network and trust the exact proxy CIDR, not the entire container address space by convenience.
  • Forward SIGTERM and allow the configured shutdown timeout before forced termination.
  • Back up both SQLite and local file objects through Trestle's consistent archive workflow.

An official image requires its own base-image policy, SBOM, provenance, update cadence and multi-architecture test gate. CP22 does not imply those guarantees.