Skip to content
Argus DSPM

Local: Offline tarball

For air-gapped environments where the target host has no internet access and cannot pull from ghcr.io. You pull the image on a “build box” that does have internet, save it to a tarball, transfer the tarball to the air-gapped target, and load it there.

When to pick this

Section titled “When to pick this”
  • The target host has no internet egress to ghcr.io.
  • You cannot or do not want to set up an internal image registry.
  • You ship the agent as part of a one-shot install bundle to an isolated network.

Prerequisites

Section titled “Prerequisites”
  • A “build box” with Docker installed and internet access to ghcr.io.
  • A way to move files to the target host (sftp, removable media, internal artifact server, etc.).
  • The target host has Docker installed and meets all the other Docker Compose prerequisites (target-account role, source credentials, token or API key). Complete Pre-flight first.

Walkthrough

Section titled “Walkthrough”

On the build box (has internet)

Section titled “On the build box (has internet)”

  1. Pull the image:

    Terminal window
    docker pull ghcr.io/argusdspm/argus-agent:stable

  2. (Optional) Verify the cosign keyless signature before saving. Argus signs every published image via GitHub Actions OIDC.

    Terminal window
    cosign verify \
      --certificate-identity-regexp 'github.com/argusdspm' \
      --certificate-oidc-issuer https://token.actions.githubusercontent.com \
      ghcr.io/argusdspm/argus-agent:stable

  3. Save the image to a tarball:

    Terminal window
    docker save ghcr.io/argusdspm/argus-agent:stable -o argus-agent-stable.tar

    The resulting file is around 290 MB.

Transfer

Section titled “Transfer”

Move argus-agent-stable.tar to the target host using whatever transport your environment allows.

On the target host (air-gapped)

Section titled “On the target host (air-gapped)”

  1. Load the image:

    Terminal window
    docker load -i argus-agent-stable.tar

  2. Run the agent the same way as the docker run or Docker Compose walkthrough. The image is now locally available, no further pull needed.

Verify

Section titled “Verify”

Identical signals to the other Local paths. First confirm the loaded image is on the target host:

Terminal window
docker images ghcr.io/argusdspm/argus-agent
# expect a row for the tag you loaded, e.g.
#   REPOSITORY                    TAG     IMAGE ID       CREATED      SIZE
#   ghcr.io/argusdspm/argus-agent stable  3e6a1fe0bcad   1 hour ago   1.28GB

Then proceed with the agent boot signals from the docker run walkthrough.

Teardown

Section titled “Teardown”
Terminal window
docker stop argus-agent && docker rm argus-agent
docker volume rm argus_agent_data
docker image rm ghcr.io/argusdspm/argus-agent:stable
rm argus-agent-stable.tar   # on both build box and target host