VALIDATOR ONBOARDING

Docker validator deployment

Requirements for a reproducible container deployment once signed images are published.

Signed image pending

Container safety requirements

Pin the image by immutable digest, not latest.
Publish image signatures, SBOM and SHA-256 digests.
Run as non-root with read-only root filesystem and dropped Linux capabilities.
Keep validator keys in a host directory or encrypted secret volume with strict permissions.
Expose only 8901/TCP, 8001/UDP and 9001/UDP.
Use restart and health policies without granting the Docker socket.

Do not use unofficial container images. A production Compose file will be published only with the signed release artifact.

WCAHT Validator Program · Public Testnet · Key files selected for pairing are read locally and never uploaded.