Air-Gapped Registry

The defining characteristic is the complete absence of any external network pathway. This is enforced through:

• Physical air gap: No network interface cards connected to external switches or routers
• Logical air gap: Disabled routing, absent default gateways, and firewall rules that drop all packets to and from external networks
• No DNS resolution: The registry cannot resolve external hostnames, preventing even accidental data exfiltration via DNS tunneling

This isolation ensures that even if the registry software itself is compromised, an attacker cannot establish a command-and-control channel to exfiltrate model weights or container images.

Artifacts enter the air-gapped environment through a strictly controlled, offline transfer process known as a sneakernet:

• Physical media transfer: Signed artifacts are written to encrypted, write-once media (e.g., optical discs, hardware-encrypted USB drives) in a connected staging area
• Malware scanning: All media undergoes mandatory antivirus and static analysis scanning on a dedicated, isolated scanning station before being introduced to the air-gapped network
• Cryptographic verification: Artifacts are verified against their Sigstore or Cosign signatures before ingestion, ensuring integrity across the physical transfer
• One-way data diode: Some architectures employ optical data diodes that physically enforce unidirectional data flow, allowing artifacts in while making outbound communication physically impossible

Once ingested, artifacts must be protected against tampering and overwrite:

• Immutable tags: Registry policies enforce that a semantic version tag (e.g., v1.2.3) can only be pushed once and is permanently bound to a specific content-addressable digest
• Content trust enforcement: The registry rejects any artifact push that lacks a valid cryptographic signature from an authorized signing identity, verified against a locally hosted Rekor transparency log replica
• WORM backing store: The underlying storage layer (object storage or block storage) is configured in a Write-Once-Read-Many mode, preventing even administrative users from modifying or deleting artifacts after ingestion
• Manifest immutability: The OCI manifest, which references all layers and configurations, is hashed and stored immutably, creating a tamper-evident chain from tag to content

Without internet access, traditional vulnerability scanners that rely on live CVE feeds cannot function. An air-gapped registry requires:

• Locally mirrored vulnerability databases: A complete, periodically updated mirror of vulnerability databases (e.g., NVD, OSV, GitHub Advisory Database) is transferred via the same sneakernet process
• Offline scanning engine: The registry integrates with a scanning engine (like Trivy or Grype) configured to use only the local database, scanning every pushed artifact for known vulnerabilities
• Policy-based admission: Using an integrated Open Policy Agent (OPA) instance, the registry can reject artifacts that exceed a defined severity threshold or contain prohibited licenses, all evaluated locally without external API calls
• SBOM attestation verification: The registry validates that every artifact is accompanied by a signed Software Bill of Materials (SBOM), enabling precise component tracking even in the disconnected environment

Air-gapped registries must provide robust availability without relying on external failover or cloud-based distribution:

• Intra-site replication: Multiple registry instances within the air-gapped boundary replicate artifacts synchronously or asynchronously, ensuring availability during maintenance or localized failures
• Pull-through caching: Downstream registry instances can act as caches, pulling artifacts from a central air-gapped registry on first request and storing them locally for subsequent pulls by Kubernetes nodes
• Garbage collection policies: Administrators define retention policies to manage storage, but deletion is always a soft delete with audit trails, never a permanent overwrite, to maintain non-repudiation
• Disconnected Kubernetes integration: The registry integrates with air-gapped Kubernetes clusters via admission controllers that verify image signatures and SBOMs before allowing a pod to start, ensuring runtime integrity matches registry integrity

Regulatory frameworks require proof of what artifacts exist and their provenance, even in disconnected environments:

• Cryptographic audit trails: Every push, pull, and policy decision is logged with a signed, timestamped entry, creating a non-repudiable record of all registry activity
• Compliance artifact export: The registry can export a signed, machine-readable report (e.g., in-toto attestation bundle) detailing all artifacts, their SBOMs, vulnerability scan results, and signature chains, for transfer to external auditors via physical media
• Role-based access control (RBAC): Granular permissions ensure that only authorized personnel can push new artifacts, while a wider group of systems and operators can pull verified artifacts for deployment
• Quota and retention dashboards: Local dashboards provide visibility into storage consumption and artifact lifecycle without any telemetry data leaving the air-gapped boundary