Air-gapped deployment

Reference pattern. This page describes a deployment pattern; it does not describe any client system. Components are named by role, and products are examples.

Context and constraints

No network connection to the outside world is allowed: a secure site, a classified network, or a facility whose policy forbids it. Everything, including model weights, software updates and licence checks, must arrive by a controlled transfer.

Diagram

Components (by role)

Data flow and trust boundaries

Data never leaves the isolated side. The only inbound flow is the signed transfer bundle, which is the main attack surface and is treated accordingly: built from pinned versions, scanned, signed, and verified against its software bill of materials on arrival.

Identity and permissions

The site's own directory, with no dependency on a cloud identity provider. Break-glass administrative accounts are documented and audited.

What is logged

As in other patterns, plus a record of every transfer: what was imported, who approved it, and its checksums.

Failure modes

• Software that phones home. Licence checks, telemetry or model downloads at start-up fail or hang. Every component is tested with networking disabled before it is selected; model and tool licences are checked for offline use.
• Stale software. Updates are slower, so security fixes need a defined cadence and an emergency path.
• Debugging without the internet. Documentation and diagnostic tools are included in the bundle.

Alternatives

A single on-premises server with a narrowly allow-listed update route, where policy permits.

Related decisions

Transfer cadence, who signs and who verifies, which components are acceptable offline.