An air-gapped deployment refers to an infrastructure configuration in which a computer system, network, or data centre is physically and logically isolated from any unsecured external network — most importantly, the public internet. The term originates from the military concept of an air gap: a literal physical separation between secure and insecure systems.
In enterprise technology, air-gapped deployments are the highest tier of network isolation. They are mandatory in contexts where data sensitivity, regulatory obligation, or threat models demand that no unauthorised data exfiltration is possible — not even through compromised software on an internet-connected host.
Why enterprises choose air-gapped deployments
The primary driver is data sovereignty. In India, regulatory frameworks including RBI's guidelines on outsourcing of financial services, SEBI's cloud adoption framework, and the DPDP Act 2023 all contain provisions that effectively require certain categories of data to remain under the direct physical and logical control of the organisation. A cloud-hosted workload — even one claiming data residency — cannot satisfy these requirements because the cloud provider retains physical access to underlying hardware.
Secondary drivers include protection from nation-state threat actors, compliance with NCIIPC (National Critical Information Infrastructure Protection Centre) directives for critical infrastructure operators, and internal governance requirements in organisations handling classified or commercially sensitive information.
What air-gapped means in practice
A true air-gap means: no inbound or outbound internet routing, no external DNS resolution, no public certificate authority chains, no SaaS-based monitoring or logging, and no external package registries. All software dependencies — container images, OS packages, Helm charts, ML model weights — must be mirrored into an internal registry before deployment. Updates must be delivered via physical media or dedicated secure transfer channels.
AravaliStack is designed from the ground up for air-gapped operation. Every component — container registry, package mirror, certificate authority, DNS, monitoring, identity, and logging — is self-contained. There are no phone-home telemetry calls, no licence validation endpoints, and no dependencies on external APIs. An AravaliStack deployment functions identically with or without an internet connection.
Air-gapped vs. on-premise vs. private cloud
On-premise simply means the hardware is in a location you control — but the software running on it may still call out to the internet. Private cloud typically refers to a virtualised environment operated by a single organisation, but connectivity policies vary. Air-gapped is the strictest constraint: it specifies network isolation regardless of where the hardware lives. A government data centre, a hospital server room, or a bank's regulated compute zone can all be air-gapped.