On this page
Guides
Task-oriented entry points into the documentation, by audience. Each guide links to the reference pages behind it. Every step names the portal page or API operation that exists today; where a step has only been tested locally, or never against the real service (GitHub, Sigstore's public infrastructure, Stripe), the guide says so at that step.
If you use CommonLayer images and charts
| Guide | Content |
|---|---|
| Using the registry | Pulling images and charts, tags versus digests, what anonymous pull allows |
| Verifying artifacts | Checking signatures, SBOMs and provenance with cosign before you deploy |
| Migrating from Bitnami | Entry point into the researched migration catalog and guides |
| Licensing | Which license applies to what: platform, template, charts, image contents, upstream |
If you maintain or want to bring a project
| Guide | Content |
|---|---|
| Project onboarding | From the project template to the first promoted release |
| Maintainer handbook | Assignments, responsibilities, SLAs, tasks, eligibility, appeals, compensation |
| Image standard and chart standard | The rules every image and chart follows |
| Publish drill | The whole pipeline run locally with real tools: what it proves and what it does not |
| Verification policy | What the platform checks before promotion |
If you contribute or fund
| Guide | Content |
|---|---|
| Contributor handbook | Community contributions, review, rewards from the flexible pool |
| Funding model | How contributions become maintainer compensation, infrastructure and reserves |
| Ledger specification | The exact accounting rules and invariants |
| Contributing to the platform code | Development setup and rules for this repository |
If you operate the platform
| Guide | Content |
|---|---|
| Deployment | Components, configuration, production requirements |
| Operations handbook | Daily operation, jobs, payouts, retention, key rotation |
| Runbooks | One section per alert |
| Backup and recovery | What to back up and how to restore |
| Disaster recovery | Scenarios and procedures |
| Repository settings | Variables, required checks and GitHub features the workflows need |
If you evaluate CommonLayer
Start with the repository README, the architecture overview, the threat model and the implementation status, which lists what is done, where it was tested (locally, on GitHub runners, or never), and what is not done; and the security review.