Air-Gapped Deployments
Manifest Self-Hosted can be installed on hosts that cannot reach the public internet. The air-gapped workflow uses the same manifest-installer CLI as a connected install, but adds a preparation phase: on a separate, internet-connected prep host you download the platform packages and vulnerability data and bundle them into a single tarball, which you then transfer to the air-gapped target host.
Before you start
Two machines
| Role | Requirements |
|---|---|
| Prep host | Reachable from the public internet. Used only to download and bundle — it does not need to match the target host's OS or architecture. Supported: Linux (x86_64 or arm64; any modern 64-bit distribution — the CLI is a single static binary), macOS 13 or later (Intel or Apple silicon), Windows 10/11 or Windows Server 2016+ (x86_64). Allow roughly 20 GB of free disk for the downloaded packages plus the assembled bundle. |
| Target host | The server that will run Manifest. Debian 12, RHEL 9, or Ubuntu 24.04 on x86_64. No internet access is required from the target host — vulnerability data is carried in with the bundle and refreshed via data updates. |
Bundle transfer plan
The air-gap bundle is a single tarball of roughly 5 GB — ~4.5 GB of platform packages, plus a few hundred megabytes for the initial vulnerability-data snapshot. Plan transfer media or file-share quota of at least 16 GB. Update bundles are about the same size: every bundle carries the platform packages for its version, and on import the target skips anything it already has.
Common mechanisms:
- Removable media (USB drive, external SSD)
- Internal-only file share or artifact repository
- Approved data-diode or one-way transfer service
Target host runtime dependencies
The target host does not need Docker, k3s, or any Kubernetes tooling installed in advance. The bundle carries the Kubernetes runtime, OS prerequisites, host-prep scripts, and the platform's container images — a fresh, supported Linux host with sudo access is enough.
Table of Contents
- Build the Air-Gap Bundle - Download packages and data on a prep host and
export-bundlethem into a single, checksum-verified tarball - Set Up the Target Host - Transfer the bundle across the air gap, import it, and run the setup wizard
- Deploy and Verify - Deploy the platform from the imported bundle, verify with
kubectl, trust the CA certificate, and load the imported vulnerability data - Update an Air-Gapped Install - Carry application and vulnerability-data updates across the air gap
Support
For additional assistance, contact Manifest Cyber support:
- Email: [email protected]
Updated about 1 month ago