Air-Gapped Deployment

​

Air-Gapped Architecture Principles

• Zero External Telemetry: The platform does not make outbound network requests, license verification calls, or phone-home requests.
• Offline Cryptographic Licensing: Licenses are verified locally using signed RSA/ECDSA cryptographic certificates.
• Container Registry Mirroring: All container images and dependencies are packaged as standalone tarballs or pushed into internal registries (Harbor, JFrog Artifactory, Sonatype Nexus).
• Offline Vulnerability Feeds: Feeds (CVE/NVD, EPSS, KEV, CWE, and scanning rules) are synced using an offline transport utility.

​

Offline Installation Steps

​

1. Prepare Offline Bundle on Connected Machine

# Download the offline installer bundle and checksums
curl -O https://packages.snapsec.co/airgap/snapsec-airgap-v2.6.tar.gz
curl -O https://packages.snapsec.co/airgap/snapsec-airgap-v2.6.tar.gz.sha256
sha256sum -c snapsec-airgap-v2.6.tar.gz.sha256

# Download latest offline threat & vulnerability feeds
snapsec-feed-sync --export --output feeds-latest.tar.gz

​

2. Transfer to Air-Gapped Environment

​

3. Load Images and Deploy

# Extract bundle
tar -xzvf snapsec-airgap-v2.6.tar.gz
cd snapsec-airgap

# Load container images into local Docker or internal registry
./scripts/load-images.sh --registry registry.local.internal:5000/snapsec

# Apply offline configuration and license
cp .env.example .env
nano .env
# Set SNAPSEC_OFFLINE_LICENSE_FILE=/path/to/license.key

# Start platform
docker compose -f docker-compose.offline.yml up -d

​

4. Import Offline Vulnerability Feeds

docker compose exec -T app snapsec-feed-importer --file /path/to/feeds-latest.tar.gz

​

Disconnected Vulnerability Feed Updates

1. Run snapsec-feed-sync --export weekly or monthly on a connected workstation.
2. Ingest the bundle into the air-gapped host.
3. Run snapsec-feed-importer --file <bundle> without interrupting active scanning or users.

​

Next Steps