Air-gapped

Updated September 13, 2026

Licence checks are offline. The signed key and public PEM are enough.

The registry-access email attaches kryptic-selfhost.zip (Compose, .env.example, up.sh, values.example.yaml, and the Helm chart kryptic-helm-<version>.tgz) and links the air-gapped image bundle. The bundle is too large to attach to the mail.

On a machine with internet access, download the bundle from the link in the email with your registry username and the password you set:

curl -fL -u '<username from the email>:<password you set>' \
  -o kryptic-airgap.tar.gz \
  '<air-gap-bundle-link-from-email>'

unzip kryptic-selfhost.zip -d kryptic

Copy kryptic-airgap.tar.gz and the unzipped kit to the offline host.

cd kryptic
docker load -i /path/to/kryptic-airgap.tar.gz

cp values.example.yaml kryptic-values.yaml
# set KRYPTIC_VERSION and DOCKER_REGISTRY from the email

On Kubernetes nodes, load the tarball into each node's containerd / k3s.

Docker Compose. Set the pull policy to missing in .env so Compose uses the loaded images instead of calling the registry (kits up to 1.3.9 default to always; newer kits default to missing):

echo 'KRYPTIC_PULL_POLICY=missing' >> .env
./up.sh up -d

Helm from the chart file in the kit (no helm repo). Set KRYPTIC_PULL_POLICY: IfNotPresent in your values file (charts up to 1.3.9 default to Always).

helm upgrade --install kryptic ./kryptic-helm-<chart-version-from-email>.tgz \
  --namespace kryptic --create-namespace \
  -f kryptic-values.yaml

Kits up to 1.3.9 do not include the chart tgz. Pull it on a machine that can reach the Helm repo from the email, then copy it to the offline host: helm pull kryptic/kryptic --version <chart-version-from-email>.

If the offline registry uses different names, set DOCKER_REGISTRY to that mirror and retag the images to match.

Then create your organization.