---
title: "Air-Gapped Install"
description: "Install the Guardian Platform with mirrored images and packaged charts."
source: "Guardian Platform"
---
Use an air-gapped install when the cluster cannot pull charts or images from public or hosted registries.

## Preparation

1. Obtain the release package and release manifest.
2. Mirror every runtime image listed in the manifest, and the upstream images below, to the customer-approved registry.
3. Preserve image tags and digests from the manifest.
4. Package or mirror the Helm chart and dependencies for the restricted environment.
5. Prepare registry credentials, image pull secrets, values, and platform secrets.

## Install Flow

Install the Guardian Platform chart from the approved internal source and override image registry values so every component pulls from the mirrored registry.

The `global.imageRepositoryPrefixOverride` redirects only source images under `ghcr.io/eqtylab/`. It does not mirror upstream images. For the gateway `psql` init container, also set `global.imageRegistryOverride` or `gateway-stack.controlPlane.waitForRegistryViews.image.repository` explicitly. Air-gapped installs that previously used the prefix alone must add this override.

The release manifest lists the EQTY Lab images only. The chart also pulls these upstream images, each with its own setting:

| Image                                             | Used by                                                    | Setting                                                            |
| ------------------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------ |
| `busybox:1.36`                                    | Auth, Governance, and Integrity dependency wait containers | `global.utilityImages.busybox`                                     |
| `docker.io/bitnamilegacy/postgresql:17-debian-12` | Bundled PostgreSQL                                         | `postgresql.image.registry`                                        |
| `postgres:17-alpine`                              | Identity provider post-install Jobs                        | `idpSetupImage`                                                    |
| `docker.io/library/postgres:17.6`                 | Gateway Stack `psql` init container                        | `gateway-stack.controlPlane.waitForRegistryViews.image.repository` |

The post-install Jobs need `psql` and `pg_isready`, and with `createPlatformAdmin` also `curl` and `jq`. `postgres:17-alpine` installs `curl` and `jq` with `apk` at runtime, which fails without internet access, so mirror an image that already contains them. The Jobs run as UID and GID 70 (the `postgres` user of `postgres:17-alpine`) with a read-only root filesystem and a writable `/tmp`, so the mirrored image must work as that user; otherwise set `idpSetupPodSecurityContext` to a user it supports.

Values that redirect every image to a mirror at `registry.customer.example`:

```yaml
global:
  imageRegistryOverride: registry.customer.example
  imageRepositoryPrefixOverride: registry.customer.example/eqtylab
  utilityImages:
    busybox: registry.customer.example/library/busybox:1.36
  secrets:
    imageRegistry:
      registry: registry.customer.example

postgresql:
  global:
    security:
      allowInsecureImages: true # Bitnami refuses a changed image registry without it
  image:
    registry: registry.customer.example

# Mirrored image with psql, pg_isready, curl, and jq
idpSetupImage: registry.customer.example/library/postgres-setup:17

gateway-stack:
  controlPlane:
    waitForRegistryViews:
      image:
        repository: registry.customer.example/library/postgres
```

Verify that the cluster never needs to reach an external registry during install or restart.

PDFGen timestamps each report it signs through a public timestamp authority, `http://timestamp.digicert.com` by default. Without a route to one, every report export fails, so sign without a timestamp:

```yaml
eqty-pdfgen:
  config:
    timestampUrl: ""
```

See [PDFGen Configuration](../pdfgen/configuration.mdx#chart-values).

## Validation Checks

- All pods pull images from the mirrored registry.
- Chart version and image digests match the release manifest.
- Sign-in, project access, attachments, reports, indicators, and certificates work according to the rollout plan.

## Support Notes

Keep the mirrored image list, chart package, values file, and validation evidence with the release records. They are needed for rollback, support, and disaster recovery.

## Related

- [Release Manifest](./release-manifest.mdx) — the image and chart checklist to mirror
- [Chart Values](./chart-values.mdx) — the full values and secrets files, including the image registry pull secret
- [Deployment Troubleshooting](./troubleshooting.mdx#images-do-not-pull) — first checks when mirrored images do not pull
- [Backup and Restore](./backup-and-restore.mdx) — keeping mirrored images and charts so a restore can reinstall
- [Connected Install](./connected-install.mdx) — the install path when the cluster can reach the registries