Airgapped Deployment
An airgapped deployment runs software on servers that have no link to the public internet. You build this setup by moving app packages, keys, and rules into a closed network. Most teams start by setting up local user directories and broad admin roles inside the boundary. When those internal roles are too wide, one bad command can break a database. How an airgapped deployment works in practice In a closed network, apps cannot pull updates or check identities over the public web. Your team must
Deployment Approval Gates: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
An airgapped deployment runs software on servers that have no link to the public internet. You build this setup by moving app packages, keys, and rules into a closed network. Most teams start by setting up local user directories and broad admin roles inside the boundary. When those internal roles are too wide, one bad command can break a database.
How an airgapped deployment works in practice
In a closed network, apps cannot pull updates or check identities over the public web. Your team must bring every container image, code package, and tool inside by hand. First, engineers check the files for threats on an outside staging machine. Next, they copy the safe files onto physical drives or push them through a one-way diode.
Inside the closed zone, a local server holds all the images and code packages. Internal hosts pull their software from this local store when they boot up. For user logins, the team sets up a local identity directory inside the private room. This local directory checks passwords and assigns a static role to each operator.
When an engineer logs in from an internal desk, the directory checks their group. If the group matches the server rule, the engineer gets a shell or database prompt. All logs stay on local disks because nothing can leave the closed room.
What network isolation solves and what it misses
Cutting the internet link stops outside hackers from reaching your servers over the web. It also stops stolen data from leaking out through a hidden background call. For high-security sites, this physical wall is a strong first step.
Still, a wall around the network does not manage what happens inside the room. Once an operator logs into an internal database, the air gap does nothing more. Native network rules only decide who can open a session on a local host. They do not inspect the commands or queries that run inside that active session.
Deployment Approval Gates: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Teams in closed sites often share broad admin accounts to fix broken apps faster. Because external cloud tools are missing, engineers get full read and write power on local stores. A tired operator can still drop a table or read plain customer emails and card numbers. Data masking is rarely set up to rewrite matched fields like phone numbers or national IDs.
Managing sessions and data inside closed networks
To keep internal systems safe, teams must look past the physical wall. You need clear rules for every query and command that runs on local hosts. Instead of giving out broad static keys, limit what each session can do in flight.
Start by separating the power to view system state from the power to change data. Require a second team member to check and approve high-risk write commands before they run. Set up local rules that rewrite sensitive fields like card numbers and emails in query results. Keep a clean, detailed log of every statement so auditors can review local work with ease.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev sits inline in the protocol beside each supported service as an open-source proxy, a sidecar for your database or API. For every query or command an AI agent or engineer runs against production, hoop.dev decides to pass, mask, block, or hold it for human approval.
First, hoop.dev guardrails block banned queries before they run or hold risky ones for review, and hoop.dev data masking rewrites matched sensitive values in responses in memory. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What is the main goal of an airgapped deployment?
The main goal is to isolate sensitive systems from public networks and outside attackers. Every file and update must pass a manual check before entering the closed room.
How do teams update software in a closed network?
Engineers download and test updates on an outside machine first. Then they move the verified files into a local package store using approved media.
Does network isolation protect databases from insider mistakes?
No, a closed network only blocks outside traffic from reaching your hosts. Local operators with broad roles can still run bad queries or read sensitive tables.