Fifteen public image repositories package the runtime, GPU prover, operator tools, recovery controls, and release checks. The current public tags and immutable pull commands are listed below, including all five supported NVIDIA SM builds.
15 public image repositoriesChecked 27 August 2026
The short version
An image is a packaged role, not the whole system.
Docker downloads the same filesystem and startup command on every machine. The coordinator assigns work, a room node runs the application, the prover agent carries proof jobs, and prover-cuda performs the GPU work. The remaining images help deploy, observe, recover, and test that path.
The cards below record 19 current references across those 15 repositories. Choose the GPU-specific build where required, then copy the digest-pinned pull command. A tag is a readable release signpost; the sha256 digest is the immutable image identity.
Docker Hub retains older and intermediate tags. This page recommends the current public pins rather than presenting every historical build. The 23 August operations and validation candidates are usable public images, but their current manifests do not carry source-revision OCI labels, so they are not presented as source-attested releases.
Run a room
These four images are the main application, execution, queue, and proof path.
Runtime · linux/amd64
zkdeal/coordinator
What it is for
Runs the coordinator API, console, and the control-plane roles that manage rooms and proof jobs.
How it works
The same packaged server can start the coordinator or a delegated worker role. It connects application activity to the proof queue and watches the L1 result.
Runs an application room node without a browser interface.
How it works
It loads a room configuration, executes allowed actions, talks to peers, requests proofs, and exposes health, readiness, metrics, and capability endpoints.
Runs the RISC Zero proof service on a supported NVIDIA GPU.
How it works
Choose sm86 for Ampere, sm89 for Ada, sm90 for Hopper, sm100 for datacenter Blackwell, or sm120 for GeForce Blackwell. The service replays a room batch in the zkVM and wraps the result as a Groth16 proof for L1 verification.
These images make an installation repeatable, inspectable, and recoverable without adding application logic.
Operations · linux/amd64
zkdeal/operator-docs
What it is for
Serves operator guides, API references, schemas, metrics, and runbooks as a small local website.
How it works
NGINX serves the versioned documentation shipped with the deployment, so an operator can read the matching guidance even when external services are unavailable.
Provides one consistent toolbox for validation, deployment, and inspection.
How it works
It packages the reviewed Python scripts with Docker, Kubernetes, Helm, Kind, Kurtosis, and MinIO clients. The same tool versions run on every operator machine.
Supplies the PostgreSQL, MinIO, encryption, backup, restore, and archive-checking tools.
How it works
The container runs the checked-in backup and restore scripts with fixed tool versions, keeping recovery commands separate from the application containers.
Decides whether a warm standby has enough evidence to become the active coordinator.
How it works
It checks health, database replay, fencing, and freshness, then asks separately scoped services to perform the promotion. It does not directly control Docker or Kubernetes.
Coordinates a long, restart-safe lifecycle test and checks that it closes cleanly.
How it works
It binds the run to one candidate, resumes from durable state, and verifies the append-only evidence. The published wrapper is not by itself proof that a release passed the soak.
Introduces known failures and bounded load during resilience tests.
How it works
It accepts only an allow-listed fault or load profile for a named candidate, records the attempt, and prevents callers from supplying arbitrary commands or targets.
This is a build environment, not a service you normally keep running.
Build image · sm89
zkdeal/prover-cuda-toolchain
What it is for
Provides the CUDA, Rust, RISC Zero, and Groth16 tools used to compile an sm89 prover.
How it works
Use it as the controlled build stage when reproducing the RTX 4090 prover. The resulting runtime belongs in prover-cuda; this image is not the HTTP proof service.