Air-gapped Registry
An air gapped registry is a private image store inside an isolated network. You set it up by syncing approved images across a secure boundary. Many teams build this setup to run apps without internet links. They often grant wide admin roles to speed up local work. Broad permissions let any user overwrite base images or delete tags. A bad image push can break every cluster inside the network. How an air gapped registry works An air gapped registry runs on local servers with no public routes. T
Registry: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
An air gapped registry is a private image store inside an isolated network. You set it up by syncing approved images across a secure boundary. Many teams build this setup to run apps without internet links. They often grant wide admin roles to speed up local work. Broad permissions let any user overwrite base images or delete tags. A bad image push can break every cluster inside the network.
How an air gapped registry works
An air gapped registry runs on local servers with no public routes. Teams pull container images from public stores onto an outside staging host. A scanning tool checks those files for known flaws and bad packages. Next, admins move the clean tar files across the network gap. They use portable drives or a one-way data link for this step. Once inside, an admin loads the image bundles into the local store. Local worker nodes then pull images from that internal host to run apps. Internal DNS rules point all cluster nodes to the local registry address. The store uses local certs so nodes trust the TLS link.
Managing roles and sync workflows
Role design controls who can push or pull inside the closed network. Most registry tools offer project roles for readers, writers, and admins. Cluster nodes only need read keys to pull images and start pods. Build servers need write keys to push new internal app builds. Human users should not share the same write keys as build servers. Teams also need a clear way to track which images enter the store. Admins sign image digests before moving files into the local zone. The local store checks those signatures before saving the new tags. This step stops anyone from loading unsigned files from a drive.
What native controls solve and what they miss
Native registry roles decide who can log in to a project space. They block guests from pushing files into protected base folders. Network walls also stop outside attackers from reaching the image store. Yet native settings leave a big gap during daily maintenance tasks. Admins still need host shell access and database keys to fix registry bugs. Static role rules only check who logs in at the start. They do not check the actual commands an admin runs on the host. An admin with valid keys can query the backend database directly. That query might expose raw user emails or phone numbers in results. Native logs also fail to tie host commands back to one person. Teams need command controls and field masking to close this local gap.
Registry: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev runs beside each supported service as an open-source proxy, a sidecar for your database or API.
First, hoop.dev guardrails block banned queries before they run. Then hoop.dev data masking rewrites matched sensitive values in responses in memory. The audit trail records every statement and verdict per resource. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
How do teams update base images in an isolated network?
Teams pull new base images onto an internet-connected staging machine first. They scan the files, export them as archives, and verify the hashes. Finally, they move the archives across the gap and load them locally.
Why do local registries fail to pull images after setup?
Most pull errors happen because worker nodes do not trust the local certificate. You must add the internal root certificate to every node in the cluster. Also check that local DNS resolves the registry name to the right IP.
How can we stop admins from deleting production image tags?
Set up tag immutability rules inside your local registry project settings. This rule blocks any user or script from overwriting an existing version tag. Give delete permissions only to an automated cleanup task with strict rules.