> ## Documentation Index
> Fetch the complete documentation index at: https://docs.snapsec.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Air-Gapped Deployment

> Install and operate Snapsec Suite in completely disconnected, zero-egress, high-security enclaves.

Snapsec Air-Gapped Edition is purpose-built for defense, intelligence, critical national infrastructure, and classified environments requiring complete isolation from the public internet.

***

## Air-Gapped Architecture Principles

* **Zero External Telemetry**: The platform does not make outbound network requests, license verification calls, or phone-home requests.
* **Offline Cryptographic Licensing**: Licenses are verified locally using signed RSA/ECDSA cryptographic certificates.
* **Container Registry Mirroring**: All container images and dependencies are packaged as standalone tarballs or pushed into internal registries (Harbor, JFrog Artifactory, Sonatype Nexus).
* **Offline Vulnerability Feeds**: Feeds (CVE/NVD, EPSS, KEV, CWE, and scanning rules) are synced using an offline transport utility.

***

## Offline Installation Steps

```mermaid theme={null}
sequenceDiagram
    participant Connected as Connected Workstation
    participant SecureMedia as Encrypted USB / Media
    participant AirGapped as Air-Gapped Host / Cluster

    Connected->>Connected: Download offline-bundle-vX.Y.Z.tar.gz
    Connected->>Connected: Download vulnerability-feed-latest.bundle
    Connected->>SecureMedia: Transfer verified packages
    SecureMedia->>AirGapped: Ingest packages in secure enclave
    AirGapped->>AirGapped: Load images: docker load < bundle.tar.gz
    AirGapped->>AirGapped: Run offline installer & import feeds
```

### 1. Prepare Offline Bundle on Connected Machine

On an authorized internet-connected machine:

```bash theme={null}
# Download the offline installer bundle and checksums
curl -O https://packages.snapsec.co/airgap/snapsec-airgap-v2.6.tar.gz
curl -O https://packages.snapsec.co/airgap/snapsec-airgap-v2.6.tar.gz.sha256
sha256sum -c snapsec-airgap-v2.6.tar.gz.sha256

# Download latest offline threat & vulnerability feeds
snapsec-feed-sync --export --output feeds-latest.tar.gz
```

### 2. Transfer to Air-Gapped Environment

Transfer the tarballs to the target air-gapped host according to your organization's secure media transfer protocol.

### 3. Load Images and Deploy

```bash theme={null}
# Extract bundle
tar -xzvf snapsec-airgap-v2.6.tar.gz
cd snapsec-airgap

# Load container images into local Docker or internal registry
./scripts/load-images.sh --registry registry.local.internal:5000/snapsec

# Apply offline configuration and license
cp .env.example .env
nano .env
# Set SNAPSEC_OFFLINE_LICENSE_FILE=/path/to/license.key

# Start platform
docker compose -f docker-compose.offline.yml up -d
```

### 4. Import Offline Vulnerability Feeds

```bash theme={null}
docker compose exec -T app snapsec-feed-importer --file /path/to/feeds-latest.tar.gz
```

***

## Disconnected Vulnerability Feed Updates

To keep your air-gapped instance updated with the latest CVEs, EPSS scores, and CISA Known Exploited Vulnerabilities (KEV):

1. Run `snapsec-feed-sync --export` weekly or monthly on a connected workstation.
2. Ingest the bundle into the air-gapped host.
3. Run `snapsec-feed-importer --file <bundle>` without interrupting active scanning or users.

***

## Next Steps

> [card] [Quickstart: First 30 Minutes](https://docs.snapsec.co/get-started/quickstart.md)
>
> Complete initial setup and run your first assessment in your air-gapped workspace.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.