Disconnected Container Runtime

The runtime is configured to deny all external image pulls by default. All container images must be sourced from a private, air-gapped registry hosted within the secure perimeter. This requires a complete mirror of all base images, application dependencies, and sidecar proxies. The runtime's imagePullPolicy is strictly enforced, and any attempt to resolve an external endpoint results in an immediate failure, ensuring no data leaks through DNS or pull requests.

To maintain integrity, runtimes in disconnected environments rely on immutable, hardened golden images. These images are built, scanned, and signed in a secure build pipeline before being manually transferred via sneakernet or a data diode into the air-gapped registry. Once deployed, containers are never patched in place; a new signed image is pushed and the old container is destroyed, adhering to strict immutable infrastructure principles.

Without connectivity to cloud-based policy engines, the runtime must enforce security policies locally. Admission controllers and Policy as Code (PaC) engines operate entirely offline, using internally stored Rego policies or custom webhooks. These controllers validate every resource creation request against cryptographic signatures, vulnerability scan results from an offline vulnerability scanner, and internal compliance rules before a pod is scheduled.

Service discovery is handled through local DNS and static service mesh configurations. Since there is no access to public certificate authorities, all inter-service communication is secured via mutual TLS (mTLS) using certificates issued by an offline certificate authority (CA). The CA root is physically secured and only activated in a controlled environment to sign subordinate certificates, eliminating trust-on-first-use vulnerabilities.

The deployment pipeline relies on physical media validation. Updates, including new container images, model weights, and vulnerability definition files, are written to removable media in a low-side environment. This media is then rigorously scanned for malware before being mounted in the high-side environment. The runtime watches these local paths for new artifacts, triggering automated canary deployments only after the artifact's digital signature is verified against a hardware-backed keystore.

The runtime's host operating system and container engine integrity are verified at startup through a measured boot process. Each component in the boot chain cryptographically measures the next before loading it, storing the hashes in a Trusted Platform Module (TPM). The runtime will only initialize if the remote attestation quote matches the expected golden measurement, preventing execution on a compromised kernel or container engine.

A Kubernetes-native security plugin that intercepts API requests before resources are persisted. In disconnected environments, it enforces policies ensuring only images from the local private registry are deployed.

• Image Policy Webhook: Validates that every pod spec references only the internal registry URL
• Mutating Webhooks: Automatically rewrites image pull specifications to point to the local registry
• Policy as Code: Uses tools like Open Policy Agent (OPA) to define rules declaratively
• Drift Prevention: Blocks manual overrides that could attempt to pull from external sources

A deployment paradigm where containers and nodes are never patched in place. Instead, a new golden image is built, tested, and deployed, with the old instance destroyed. This aligns perfectly with air-gapped security models.

• Golden Image Pipeline: Builds hardened images in a controlled environment before transfer
• Immutable Snapshots: Creates tamper-proof point-in-time copies for forensic baselines
• Rollback Strategy: Enables instant reversion to a known-good state by redeploying a previous image
• Configuration Drift Elimination: Prevents undocumented changes that accumulate over time in long-running systems

The process of running security scans against container images and running workloads using a locally hosted vulnerability database. Definition files are manually imported via removable media.

• CVE Database Import: Transfers vulnerability feeds via data diode or USB from connected networks
• Trivy Offline Mode: Tools like Trivy support air-gapped scanning with pre-downloaded databases
• Runtime Scanning: Continuously monitors running containers for newly discovered vulnerabilities
• Compliance Reporting: Generates audit-ready reports without external data exfiltration

The practice of defining security and operational rules in machine-readable files stored in version control. In disconnected runtimes, PaC ensures consistent enforcement without relying on external policy engines.

• Rego Policies: Uses OPA's Rego language to define complex admission rules
• GitOps Integration: Stores policies alongside application manifests in a local Git repository
• Automated Remediation: Automatically rejects non-compliant resources with clear violation messages
• Audit Trail: Every policy decision is logged for forensic analysis in the air-gapped environment

A specialized Kubernetes distribution configured to operate GPU workloads without cloud dependencies. It bundles all required components—container runtime, registry, and monitoring—into a self-contained deployment.

• GPU Operator Offline: NVIDIA GPU Operator deployed from local Helm charts without internet
• Local Helm Repository: Hosts all charts internally for deploying AI serving frameworks
• Node Feature Discovery: Operates in offline mode to label nodes with hardware capabilities
• Resource Isolation: Uses cgroups and NUMA pinning to guarantee GPU access for inference workloads