Message Ops

Production uses vendor-built linux/amd64 Web, API and Worker images. Your Azure Container Apps pull them from your Azure Container Registry (ACR) using managed identity. Customers do not build application images from source or pull production workloads from a vendor development registry.

Obtain the approved 1.7.1 delivery from your Particle Horizon supplier: release identity, approved image transfer method, integrity/authenticity information and the matching deployment kit. Confirm access and delivery contents before provisioning. An offline bundle, when supplied, includes image archives, verification tools, Terraform and deployment documents. A deployment manifest describing existing registry images is a different artifact and is not an offline image bundle.

If you receive an offline bundle

Work in an isolated intake directory on a trusted operator host with GNU tar, SHA-256 tools, Node.js 24 and Docker or equivalent OCI tooling. Obtain authenticity information through the approved supplier channel; checksums bundled with a file do not independently establish who supplied it.

For a delivered archive named particle-horizon-message-ops-1.7.1.tar.gz:

tar -xzf particle-horizon-message-ops-1.7.1.tar.gz
cd particle-horizon-message-ops-1.7.1
sha256sum -c SHA256SUMS
node verification/verify-bundle.mjs --bundle-dir .

Every checksum and verifier check must pass. The verifier validates the manifest, file inventory and archive hashes. It needs no package installation or network access. If Docker is installed, it also attempts to load the images. It does not verify a cryptographic signature or establish registry signature preservation. Perform the separately supplied signature verification and your organization’s scanning before approval. A Docker save/load archive does not carry a registry’s separate image-signature artifacts.

Confirm the delivery identifies version 1.7.1 and contains matching Web/API/Worker artifacts and deployment configuration. Do not substitute a development build or another release when an artifact is missing; obtain the approved delivery from the supplier.

Publish approved images to your ACR

A fresh registry is created during the infrastructure-only stage of Azure Installation. The publishing host needs ACR network/DNS access and AcrPush; authentication alone does not reach a private endpoint. Keep registry admin credentials disabled.

Load each delivered archive and record the actual loaded reference from the command output:

docker load -i images/message-ops-web.tar
docker load -i images/message-ops-api.tar
docker load -i images/message-ops-worker.tar

Set ACR_NAME to your registry resource name, and LOADED_WEB_IMAGE, LOADED_API_IMAGE, LOADED_WORKER_IMAGE to those exact loaded references. Do not assume the archives contain a particular tag or repository prefix.

ACR_LOGIN_SERVER=$(az acr show --name "$ACR_NAME" --query loginServer -o tsv)
az acr login --name "$ACR_NAME"
docker tag "$LOADED_WEB_IMAGE" "$ACR_LOGIN_SERVER/message-ops/web:1.7.1"
docker tag "$LOADED_API_IMAGE" "$ACR_LOGIN_SERVER/message-ops/api:1.7.1"
docker tag "$LOADED_WORKER_IMAGE" "$ACR_LOGIN_SERVER/message-ops/worker:1.7.1"
docker push "$ACR_LOGIN_SERVER/message-ops/web:1.7.1"
docker push "$ACR_LOGIN_SERVER/message-ops/api:1.7.1"
docker push "$ACR_LOGIN_SERVER/message-ops/worker:1.7.1"

After publication, query each exact tag in your registry:

az acr repository show --name "$ACR_NAME" --image message-ops/web:1.7.1 --query digest -o tsv
az acr repository show --name "$ACR_NAME" --image message-ops/api:1.7.1 --query digest -o tsv
az acr repository show --name "$ACR_NAME" --image message-ops/worker:1.7.1 --query digest -o tsv

Record each returned digest with its repository. Deployment inputs use your-registry.azurecr.io/message-ops/api@sha256:... and the corresponding Web/Worker references. Never assume the vendor-side digest survives an archive/load/push round trip unchanged. If approved images are already delivered to your registry, verify their release identity and query those registry references instead.

Keep the approved delivery, verification results and customer digest triple with the change record. Retain current and previous deployable images for recovery. Then continue with Azure Installation or Manual Azure Installation.