On-premises & Air-gapped
Private data centers, internal labs, and networks that cannot reach the public internet, including promotion out to a customer site.
Who this is for
- Cyber security vendors with internal labs and remote customer deployments
- Teams where production has no outbound internet
- A private data center that still has to ship to a customer site
Every boundary crossing is a deliberate step
Mirrored dependencies, segmented runners, and a promotion path designed so builds move between zones only on purpose. Nexus mirrors and per-zone Jenkins agents, not one runner that can see every network.
The lab before the customer site
Internal labs validate the build before anything reaches production or a customer site. The artifact that leaves is the one the lab already ran.
The same rules on both sides
Dev and the isolated network use the same promotion rules, so a build is not loose in the lab and strict at the customer site.
Capabilities
- Promotion across zones that cannot share a network
- Offline registries and sanctioned artifacts
- Per-zone CI runners with no outbound access
- A path from the lab to a customer site
Example: Air-gapped CI/CD
Common questions
Can you work with Jenkins and Ansible?
Yes. The network decides the tools. Jenkins, Ansible, Nexus mirrors, and Helm are normal on these estates.
How do remote customer deployments fit in?
The path is dev, the internal lab, production, then a controlled session from your network to the customer site. What goes out is the lab-validated artifact.
Do you only work on fully air-gapped estates?
No. The same zone-by-zone path applies when the rule is strict egress, or when most of the estate is on-premises and one piece is in the cloud.