Helm Chart Container Images

This document lists all container images used by the Unstract Platform Helm chart and explains how to enumerate them for pre-pulling or mirroring to a private registry.

Listing Images Automatically

Prerequisites

You need to pull the Helm chart before running the script. If you haven't already:

helm pull oci://us-central1-docker.pkg.dev/pandoras-tamer/unstract-on-prem/unstract-platform --untar

The chart ships with a helper script that renders every image reference from a given values overlay:

cd charts/unstract-platform

# Default on-prem images (uses sample.on-prem.values.yaml)
../scripts/list_helm_images.sh

# Custom values overlays (same flags as helm install -f)
../scripts/list_helm_images.sh -f on-prem.values.yaml -f on-prem.secret.yaml

# Output as markdown table or CSV
../scripts/list_helm_images.sh -f on-prem.values.yaml -o markdown
../scripts/list_helm_images.sh -f on-prem.values.yaml -o csv

note

The script runs helm template under the hood, so helm must be on your PATH and chart dependencies must be available.

Image Reference

The default registry for all Unstract application images is:

us-central1-docker.pkg.dev/pandoras-tamer/unstract-on-prem

This is configured via global.unstract.image.registry in values.yaml.

Core Services

Service	Image Name	Default Tag	Always Deployed
Backend API	backend	rc.251	Yes
Frontend	frontend	rc.251	Yes
Platform Service	platform-service	rc.251	Yes
Prompt Service	prompt-service	rc.251	Yes
Runner	runner	rc.251	Yes
Unified Worker	worker-unified	rc.251	Yes
X2Text Service	x2text-service	rc.251	Yes

All core services share the same tag, controlled by the UNSTRACT_APPS_VERSION anchor in values.yaml. The exact tag varies per release — refer to the On-Prem Release Notes for version details.

Infrastructure Services

Service	Image Name	Default Tag	Registry
Redis	bitnami-redis	7.2.4-debian-12-r13	us-central1-docker.pkg.dev/pandoras-tamer/unstract-on-prem
MinIO (standalone)	bitnami-minio	2024.12.18-debian-12-r0	us-central1-docker.pkg.dev/pandoras-tamer/unstract-on-prem
PgBouncer	pgbouncer	1.18.0	docker.io/edoburu

Init Containers

Service	Image Name	Default Tag	Always Deployed
DB Connection Check	db-connection-check	v1.0.0	Yes

This init container verifies DB, Redis, and RabbitMQ connectivity before service startup.

Document Processing

Service	Image Name	Default Tag	Registry
LibreOffice X2PDF	libreoffice-x2pdf	v2.2.3	us-central1-docker.pkg.dev/pandoras-tamer/unstract-llm-whisperer-on-prem

Tool Images (Pulled at Runtime)

These images are not pulled during Helm deployment but are referenced in ConfigMaps and pulled by the runner at workflow execution time. No additional deployment configuration is needed — they use the same global registry:

Service	Image Name
Structure Tool	tool-structure
Tool Sidecar	tool-sidecar

Worker Pods

All worker pods (file processing, API deployment, callbacks, notifications, scheduling, log consumer, bulk download) use the worker-unified image with different Celery queue configurations. No additional images are required beyond those listed above.

Overriding Image References

Change the default registry (air-gapped / private mirror)

global:
  unstract:
    image:
      registry: my-private-registry.example.com/unstract

This redirects all core services, init containers, and tool images.

Pin a specific tag for all services

global:
  unstract:
    image:
      tag: "v0.156.1"

Override a single service image

backend:
  image:
    repository: my-private-registry.example.com/custom-path/backend
    tag: "v0.156.1"

Override infrastructure images

redis:
  image:
    registry: my-private-registry.example.com
    repository: bitnami/redis
    tag: 7.2.4-debian-12-r13

minio:
  image:
    registry: my-private-registry.example.com
    repository: bitnami/minio
    tag: 2024.12.18-debian-12-r0

dbproxy:
  image:
    repository: my-private-registry.example.com/edoburu/pgbouncer
    tag: 1.18.0

Image pull secret

If your private registry requires authentication:

global:
  imagePullSecrets:
    - name: your-registry-secret

kubectl create secret docker-registry your-registry-secret \
  --namespace unstract \
  --docker-server=my-private-registry.example.com \
  --docker-username=<username> \
  --docker-password=<password>

Pre-pulling Images

To pre-pull all required images on every node before a deployment:

# 1. List the images for your values overlay
../scripts/list_helm_images.sh -f on-prem.values.yaml > images.txt

# 2. Pull on each node (or use a DaemonSet)
while read -r img; do
  docker pull "$img"
done < images.txt

For air-gapped environments, mirror the images to your private registry and update global.unstract.image.registry accordingly.

Registry Domains to Whitelist

If your network uses egress filtering, ensure the following domains are accessible from your Kubernetes nodes:

Domain	Purpose
us-central1-docker.pkg.dev	Unstract container images and Helm chart OCI registry
docker.io	Third-party images (PgBouncer)