The user clicks Prepare environment. The app installs/starts Docker Desktop when needed, checks for the exact runtime image in the local Docker cache, and otherwise downloads it from Docker Hub by immutable digest in runtime/runtime-release.json. It then ensures the pinned WordPress and MariaDB images are present, runs the runtime's offline self-check, prepares the html2wp plugin, and only then activates the new image ID. A failed or cancelled preparation leaves the old active runtime untouched. Environment maintenance uses the same exclusive lock as conversion steps, so no running project changes image underneath it.
The Docker image is not in the app/DMG. First setup needs internet for Docker, the runtime, and any missing dependencies; a fully cached setup can run offline. Docker Hub may enforce anonymous pull limits; signing in to Docker Desktop resolves those limits. Publisher credentials and update signing keys are never embedded in the app.
To publish a changed runtime, sign in to Docker Hub and run python3 scripts/bundle-runtime.py --namespace <your-docker-hub-namespace> (or pass --reuse-image <verified-local-image> when every functional runtime and Gutenberg skill file matches the existing image). The script runs the offline self-check, pushes a versioned tag, verifies the public manifest, and writes the exact digest and accepted local image IDs to runtime/runtime-release.json. Review and commit that manifest before building the app. The consumer never builds a runtime image.
The official Tauri updater checks latest.json from the public binary-only GitHub repository iOSDevSK/html2wp-desktop-releases. The app checks automatically at launch and offers Install and restart in Settings. Installation waits until no conversion is running and holds the environment lock through replacement. Tauri verifies the .app.tar.gz signature against its embedded public key. The private signing key is stored outside the repository at ~/.config/html2wp/tauri-updater.key and must be backed up securely; losing it prevents updating existing installations. The DMG is for first installation, and versions before this updater release need one manual update. Tauri signing does not replace Apple Developer notarization.
For a macOS release, set TAURI_SIGNING_PRIVATE_KEY to the key path and TAURI_SIGNING_PRIVATE_KEY_PASSWORD='' for the unencrypted local key, run npm run bundle:mac, then python3 scripts/prepare-desktop-release.py. The script refuses an unpublished runtime, a DMG or updater archive above 200 MB, a bundled Docker archive, a manifest mismatch, an invalid updater signature, or different app contents inside the DMG and updater archive. It stages only the DMG, signed updater archive, latest.json, checksums and dependency inventory under ignored release-assets/<version>/. Publish those assets as a public GitHub Release with the matching v<version> tag. Keep source bundles in the private source repository.
Docker Desktop itself is downloaded from Docker's vendor, with pinned checksums in runtime/docker-installers.json. macOS verifies Docker's code signing identity before its installer runs. The user's OS handles authorization and Docker's licence acceptance. Windows may require WSL/virtualization or a restart. Automatic Linux installation supports Debian/Ubuntu and Fedora on x86_64; other distributions and architectures can use an already running local Docker Engine.