1. Get Ayakaleaf Pro Images

Use the same Ayakaleaf Pro images as the Toolkit.

Kubernetes runs the same images as the Toolkit. There is no separate Kubernetes image.

Image	Used by
ghcr.io/ayaka-notes/overleaf-pro:6.3.2	the Deployment overleaf
ghcr.io/ayaka-notes/overleaf-pro/git-bridge:6.3.2	Git integration (optional), same tag as above
ghcr.io/ayaka-notes/texlive-*	compiles, pulled into Docker on the nodes in step 0

The images are public on ghcr.io for amd64 and arm64, so the kubelet can pull them without credentials.

Always use a version tag, such as 6.3.2, not latest. Upgrades run database migrations and must follow Upgrading on Kubernetes; a moving tag would upgrade a pod whenever it is rescheduled.

Q&A

Our nodes cannot reach ghcr.io. What do we do?

Answer: Copy the images into a registry the nodes can reach and use that name in the manifests, for example:

docker pull ghcr.io/ayaka-notes/overleaf-pro:6.3.2
docker tag ghcr.io/ayaka-notes/overleaf-pro:6.3.2 registry.example.com/ayakaleaf/overleaf-pro:6.3.2
docker push registry.example.com/ayakaleaf/overleaf-pro:6.3.2

For a registry without TLS, containerd needs a /etc/containerd/certs.d/<registry>/hosts.toml with server = "http://<registry>" on every node, and config_path set as in step 0. Docker itself only pushes over plain HTTP to localhost, so push through localhost:<port> on the registry host or add it to insecure-registries.