stella-ops.org

What Is It

Stella Ops Suite is a self-hosted release orchestration control plane for non-Kubernetes infrastructure. It sits between CI, container registries, and servers. Rather than simply scanning for CVEs, it ties SBOMs, VEX, reachability proofs, policy decisions, approvals, and deployment outcomes to every release promotion, then generates signed Decision Capsules that auditors can verify offline and replay deterministically.

Core Capabilities

Its core concept is “evidence-grade releases.” SBOM support covers SPDX and CycloneDX, while VEX support includes OpenVEX/CSAF and conflict resolution across multiple issuers. Reachability analysis combines static call graphs, manifest analysis, binary symbols, and optional eBPF runtime probes to reduce false positives from traditional scanners. On the deployment side, it focuses on non-K8s environments: Docker Compose, SSH/WinRM, ECS/Fargate, Nomad, and .NET scripts, with support for canary, rolling, blue-green deployments, and digest-level rollbacks. It also supports air-gapped environments, an Offline Kit, no mandatory telemetry, and regional encryption configuration.

Pricing and Licensing

The product is source-available under BUSL-1.1, while the verification layer is Apache-2.0. The free edition includes 3 environments and 999 scans/month, but is limited to evaluation and development. Plus costs ¥2,299/month, and Pro costs ¥7,699/month, scaling by environment count and the volume of deep scans for new digests. The Enterprise plan supports custom SLAs, procurement documentation, and dedicated support. Prebuilt signed images and the Offline Kit require early access.

Pros and Cons

The main advantages are a complete audit trail, strong suitability for self-hosted and isolated networks, clear support for non-K8s infrastructure, and the ability to unify scanning, policy, and deployment into a single evidence model. The downsides are also clear: it is still a closed early release, with Public beta/GA planned for 2026; its ecosystem and real-world production references still need validation; and default support leans toward self-service, with Pro support tickets charged on demand.

Who It’s For and Access from China

It is best suited to security, platform, and compliance teams, especially in regulated SaaS, fintech, defense, or sovereign network scenarios. It is less suitable for teams that only need lightweight vulnerability scanning or have fully committed to Kubernetes-native GitOps. Access from China is not specified in the text. For payments, only PO, invoicing, and enterprise procurement terms are mentioned, with no local payment methods listed. Alternative or complementary tools include Trivy, Grype, Snyk, Octopus, GitHub/GitLab CI, Jenkins, and Harness.