Update an Air-Gapped Install

Updates to an air-gapped deployment always start back on the internet-connected prep host: re-download, re-bundle, re-transfer, re-import. There is no data-only bundle — every bundle carries the platform packages for its version, and the target skips anything it already has on import.

Application updates (new platform version)

On the prep host:

manifest-installer download --version <new-version>
manifest-installer export-bundle --version <new-version>

Transfer the tarball and verify its checksum as in Set Up the Target Host. Then, on the target host:

Take an instance snapshot of the target host. The installer does not back up the cluster for you — recovery from a failed upgrade is the snapshot you take here (VM snapshot, EBS snapshot, hypervisor snapshot, whatever your platform provides).

Apply the update:

manifest-installer import-bundle /path/to/manifest-self-hosted-<new-version>-<YYYYMMDD>.tar
manifest-installer deploy --version <new-version>

When the requested version is newer than what's installed, deploy confirms interactively before applying it. Pass --yes to skip the confirmation for unattended runs, but only when a wrapper around deploy takes the snapshot from step 1.

Re-running setup is only needed if the new version's config schema has changed. Release notes will call this out when applicable.
If the upgrade fails partway, restore the host from the instance snapshot you took in step 1, then contact support if needed. There is no manifest-installer rollback command.
Downgrades are refused. Restore from your pre-upgrade snapshot instead, or contact support for an assisted downgrade.

Data updates

In an air-gapped deployment, vulnerability data (NVD, OSV, KEV, EPSS) does not refresh automatically — it must be carried across the air gap on a periodic basis. On the prep host, pull only what's new since your last sync, then bundle it:

manifest-installer download-data --since <YYYYMMDD>
manifest-installer export-bundle --include-data

export-bundle has no date flag: --include-data bundles exactly what your most recent download-data run selected, so control coverage with --since. See Build the Air-Gap Bundle for the full reference.

Transfer the tarball, verify its checksum, and import-bundle it on the target as in Set Up the Target Host.

🚧
Data refresh consumption
The mechanism by which the running platform consumes newly-imported data is being finalized; this page will be updated once that work lands. In the meantime, contact Manifest support to coordinate data refreshes.

For recommended update cadence and data-export procedures, contact Manifest support at [email protected].