# Air-Gapped Environments

This guide demonstrates how to download and package the Immuta Enterprise Helm chart and its dependencies for consumption on a separate network with no internet access.

## Prerequisite

{% hint style="info" %}
**Skopeo installation**

This guide utilizes the `skopeo` command to copy container images; ensure it's installed before proceeding. Refer to the [skopeo documentation](https://github.com/containers/skopeo/blob/main/install.md) for further assistance.
{% endhint %}

### Checklist

#### Skopeo

* [ ] Skopeo is authenticated with Immuta's registry on the networked machine.
* [ ] Skopeo is authenticated with the private registry on the air-gapped machine.

#### Helm

* [ ] Helm is authenticated with Immuta's registry on the networked machine.

## Download artifacts

This section demonstrates how to download the Helm chart and container images to your local machine. These artifacts will be packaged and transferred to the air-gapped environment later.

{% hint style="info" %}
Upon completion of these steps, the saved artifacts can be found in local directory `offline-kit`.
{% endhint %}

1. Create a directory named `offline-kit`.

   ```bash
   mkdir ./offline-kit
   ```
2. Download the Helm chart into directory `offline-kit`.

   <pre class="language-bash"><code class="lang-bash"><strong>helm pull oci://ocir.immuta.com/stable/immuta-enterprise --destination ./offline-kit --version 2026.1.4
   </strong></code></pre>
3. Extract file `DIGESTS.md` from the Helm chart archive.

   ```bash
   tar --extract --gzip --strip-components=1 --directory=./offline-kit --file=./immuta-enterprise-*.tgz immuta-enterprise/DIGESTS.md
   ```
4. Open file `./offline-kit/DIGESTS.md`. This file includes the name and digest of every container image referenced by the Helm chart.
5. Download each image listed in file `DIGESTS.md` using [skopeo](https://github.com/containers/skopeo). Each image will be saved to directory `offline-kit` with the filename`<name>-<tag>.tar`.

   <pre class="language-sh"><code class="lang-sh"><strong>read -r -p "Enter the container image to download (e.g., docker.io/hello-world:latest):" image &#x26;&#x26; \
   </strong>skopeo copy docker://"$image" docker-archive:"offline-kit/$(sed 's#.*/##; s#:#-#g' &#x3C;&#x3C;&#x3C; "$image").tar"
   </code></pre>

## Transfer artifacts

This section demonstrates how to push the previously archived container images to a private registry that's accessible from within your air-gapped environment.

{% hint style="info" %}
The exact process for transferring files into an air-gapped network can vary significantly depending on your specific security policies and infrastructure.
{% endhint %}

1. Transfer directory `offline-kit` (created in the previous section) onto a machine that's within your air-gapped environment.
2. Push each image to your private registry using [skopeo](https://github.com/containers/skopeo).

   <pre class="language-bash"><code class="lang-bash"><strong>skopeo copy docker-archive:offline-kit/&#x3C;name>-&#x3C;tag>.tar docker://&#x3C;private-registry-fqdn>/immuta/&#x3C;name>:&#x3C;tag>
   </strong></code></pre>

## Chart installation

{% hint style="info" %}
A Helm chart can be referenced from a local file path, instead of remotely if desired. It is not necessary to reference it remotely. When referring to documentation, substitute any references to `oci://ocir.immuta.com/stable/immuta-enterprise` with the path to the unarchived (`.tgz`) chart file.
{% endhint %}

Edit the `immuta-values.yaml` to reference the [private container registry and images](/latest/configuration/self-managed-deployment/configure/private-container-registries.md).


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://documentation.immuta.com/latest/configuration/self-managed-deployment/configure/immuta-in-an-air-gapped-environment.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.