> For the complete documentation index, see [llms.txt](https://documentation.immuta.com/latest/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.immuta.com/latest/configuration/self-managed-deployment/configure/immuta-in-an-air-gapped-environment.md).

# Air-Gapped Environments

This guide demonstrates how to move the Immuta Enterprise Helm chart and its container images into an environment with no internet access. Two artifacts cross the boundary:

* The Helm chart archive (`.tgz`)
* The container images, copied by digest into archive files

The same process applies to the initial install and to every upgrade: Each release is one chart archive plus one set of images.

Every image is copied **by digest**, taken from the `DIGESTS.md` file inside the chart itself. A digest is content-addressed, so an image that arrives in your registry with the expected digest is bit-for-bit the image Immuta published; the transfer method cannot silently alter it.

## Requirements

* [Skopeo](https://github.com/containers/skopeo) and [Helm](https://helm.sh/docs/intro/install/) on both the connected machine and a machine inside the air-gapped environment (skopeo moves the images; Helm pulls the chart on one side and installs it on the other).
* On the connected machine, skopeo and Helm are authenticated with ocir.immuta.com. Credentials are provided by Immuta; there is currently no self-service lookup. Contact your Immuta representative or [Immuta Support](https://support.immuta.com) if you do not have them.
* On the air-gapped machine, skopeo is authenticated with your private registry.

## On the connected machine: Download the Helm chart and archive images

1. Download the Helm chart.

   ```bash
   mkdir ./immuta-2026.2.2
   helm pull oci://ocir.immuta.com/stable/immuta-enterprise --destination ./immuta-2026.2.2 --version 2026.2.2
   ```
2. Extract `DIGESTS.md` (the chart's own manifest of every image it references, with digests) and convert it into a plain image list.

   ```bash
   tar --extract --gzip --strip-components=1 --directory=./immuta-2026.2.2 --file ./immuta-2026.2.2/immuta-enterprise-2026.2.2.tgz immuta-enterprise/DIGESTS.md
   awk -F '|' '/sha256:/ { gsub(/ /, ""); print $2, $3 }' ./immuta-2026.2.2/DIGESTS.md > ./immuta-2026.2.2/images.txt
   ```

   Each line of `images.txt` is `<image>:<tag> <digest>`. This file travels with the archives and drives every later step.
3. (Optional) Verify Immuta's signature on each image before archiving, following the [Cosign verification guide](/latest/configuration/self-managed-deployment/configure/cosign-verification.md).
4. Archive every image, by digest, in one pass. `--all` preserves every architecture; `--preserve-digests` makes skopeo fail rather than alter content. A failed copy stops the loop, so a partial bundle cannot be mistaken for a complete one.

   ```bash
   while read -r image digest; do
       skopeo copy --all --preserve-digests \
           "docker://${image%:*}@${digest}" \
           "oci-archive:./immuta-2026.2.2/$(basename "${image%:*}")-${image##*:}.tar:${image}" || exit 1
   done < ./immuta-2026.2.2/images.txt
   ```

## Transfer

Move the `immuta-2026.2.2` directory into the air-gapped environment using your organization's approved transfer process. Everything needed is in that one directory: the chart archive, `images.txt`, and one `.tar` per image.

## In the air-gapped environment: Push images to your private registry

1. Push every image to your private registry, preserving each image's repository path and digest. Replace `<private-registry-fqdn>` with your registry.

   ```bash
   while read -r image digest; do
       path="${image#*/}"
       skopeo copy --all --preserve-digests \
           "oci-archive:./immuta-2026.2.2/$(basename "${image%:*}")-${image##*:}.tar" \
           "docker://<private-registry-fqdn>/${path}" || exit 1
   done < ./immuta-2026.2.2/images.txt
   ```

   If your registry requires a path prefix (for example, an Artifactory repository), push to `<private-registry-fqdn>/<prefix>/${path}` instead, verify the same location in the next step, and map the repositories as described in the [Private container registries guide](/latest/configuration/self-managed-deployment/configure/private-container-registries.md#registry-with-a-path-prefix).
2. Verify the pushed images. Every digest in your registry must equal the digest in `images.txt`. Any mismatch fails loudly.

   ```bash
   while read -r image digest; do
       path="${image#*/}"
       actual=$(skopeo inspect --raw "docker://<private-registry-fqdn>/${path}" | skopeo manifest-digest /dev/stdin)
       [ "$actual" = "$digest" ] && echo "OK    ${path}" || { echo "FAIL  ${path}: ${actual} != ${digest}"; exit 1; }
   done < ./immuta-2026.2.2/images.txt
   ```

## Install or upgrade

1. Point the chart at your registry. Because the repository paths were preserved, pointing the chart at your registry is a single value — no per-image overrides:

   ```yaml
   global:
     imageRegistry: <private-registry-fqdn>
   ```

   If your registry requires authentication, also create a pull secret and set `global.imagePullSecrets`, as described in the [Private container registries guide](/latest/configuration/self-managed-deployment/configure/private-container-registries.md#pull-secret). The credentials skopeo used to push are not used by Kubernetes to pull.

   If your registry requires a path prefix (for example, an Artifactory repository), map the repositories instead of overriding each image. See the [Private container registries guide](/latest/configuration/self-managed-deployment/configure/private-container-registries.md#registry-with-a-path-prefix) for details.
2. Install or upgrade from the local chart archive. Wherever other guides reference `oci://ocir.immuta.com/stable/immuta-enterprise`, substitute the archive path and omit `--version`:

   ```bash
   helm upgrade --install <release-name> ./immuta-2026.2.2/immuta-enterprise-2026.2.2.tgz --values immuta-values.yaml
   ```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://documentation.immuta.com/latest/configuration/self-managed-deployment/configure/immuta-in-an-air-gapped-environment.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.