Skip to content
industricAgents

Air-gapped & private registries

Run Industric from a private registry with no public-internet access. Mirror the required images and configure local services and dependencies for offline use.

Air-gapped and egress-restricted clusters work. Beyond its own image, the autonomic-manager launches pods from a set of published container images. For an offline install, mirror those images into your own registry and point the operator and platform manifests at the mirror.

Getting the image list
The exact set of images to mirror (and their pinned tags) moves with each release, so it isn't listed here. Pull the current list from your release bundle or ask your Industric contact, then mirror them into your registry before installing.

Supported

There are two offline shapes, depending on what the cluster can reach:

  • Private registry, still managed. The cluster can reach your platform but not the public registry. Mirror images locally and keep the operator connected to the control plane.
  • Fully offline. The cluster can't reach anything external. Mirror images and run the operator unmanaged (see below).

Point at your registry

Point each image reference at your mirror. The installer takes the operator and platform images as flags:

manager env· yaml
1env:
2  - name: AUTONOMIC_IMAGE_REGISTRY
3    value: registry.example.com/exo-mirror

Via Helm, set image.manager.repository (and the platform image in its values). An individual Agent or Tool can pin its own image through the CR's image field, useful when only part of the fleet is mirrored.

Pull secrets

A private mirror needs image pull secrets. Via Helm that's image.pullSecrets; for raw manifests, attach imagePullSecrets to the manager pod or its ServiceAccount. Configure pull credentials separately for workload pods or their ServiceAccounts in each namespace; the manager's credentials are not inherited.

Fully offline

If the cluster can't reach the platform at all, run the operator unmanaged (AUTONOMIC_MANAGED=false, the default). Agents, Tools, and the rest still reconcile and run from your mirrored images. For fully offline operation, model providers, MCP servers, and bootstrap downloads must also be local or disabled. Mirroring images alone does not remove external dependencies. Unmanaged mode has no control-plane connection or centralized dashboard and audit.