Air-Gapped Installation
Build the guardian images on a connected host, then install them on a host with no outbound network access.
What Travels to the Target
The guardian runs with no outbound access, but its build downloads base images and sources. Build on a host with internet access, then carry the result to the target host. Your realm credential never goes to the connected host.
VeilNet hands over the realm credential and the anchor binaries on hard media. The connected host builds the binaries into the images. The images, the checkout, the binaries and the SBOMs then travel to the target on one medium. The realm credential never goes to the connected host. You carry it to the target separately and place it in the secrets directory there. Once the target runs, it needs only one route out, from its admin nodes to your own bootstrap nodes.
| What | How it travels | Why |
|---|---|---|
| The images | On one medium, from the connected host | Every image the stack runs, and a small utility image that setup uses to stage certificates. The target does not need the FIPS base. |
| The guardian checkout | On the same medium | Setup runs from it. |
| The anchor binaries | On the same medium | They are built into the API server's image, and setup also checks for them in ./bin on the target. |
| An SBOM for each image | On the same medium | An air-gapped site cannot generate one later. |
| The realm credential | Separately, by hand, from VeilNet's hard media | It carries the private key of your realm's root, so keep it with the secrets, not with the images. Once it is handed over, it cannot be taken back. |
Building on a Connected Host
$ cp anchord-linux-amd64 anchorctl-linux-amd64 ./bin/
Use the pair that VeilNet supplies with your realm credential. The pair is pinned to your realm's tree, and the images you build here include it.
Installing on the Target
$ zstd -d -c guardian-images.tar.zst | docker load
- In setup's settings check, the credential line ends with
renewal offlineif VeilNet issued your credential for an offline deployment. - The run ends with
Guardian is running. - The console's dashboard shows renewal of the realm credential as offline. This is a normal state, not an error.
Running with No Egress
Once installed, the guardian works with no outbound access:
- You replace the realm credential by hand. An offline credential has no renewal address, so the guardian never connects out. VeilNet hands over a fresh credential before the old one expires. See Online, Offline and Expired.
- Realm control works. The admin nodes connect only to your own bootstrap nodes. Blocks, compartment moves and network changes from the console need no other route.
- Control from conflux works. With console control off, the console hands over a control credential once, as a file. You enrol it with conflux, and nothing renews it.
- The target downloads nothing. The anchor binaries travel inside the API server's image. The release details in a realm credential are for your information only, and nothing acts on them.