Prerequisites

All prerequisites are the same as the Standard Online Install except for the requirement of an active internet connection on the Virtru Private Keystore (CSE) host.

All images must be downloaded from a machine that has internet access and then transferred to the CSE host.

• You have a Linux server (Ubuntu/RHEL/Alma) with Docker installed.

• You have root or sudo privileges.

Overview

This document provides instructions to install the Virtru Private Keystore (VPK) for CSE in an offline or air-gapped Linux environment.

The process involves preparing installation files on a connected machine, transferring them to the offline environment, and executing the setup script in offline mode.

Docker

#Install Docker
sudo curl -sSL https://get.docker.com/ | sh

Verify Docker is running

docker run hello-world

The response should be similar to:

Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
1b930d010525: Pull complete 
Digest: sha256:6540fc08ee6e6b7b63468dc3317e3303aae178cb8a45ed3123180328bcc1d20f
Status: Downloaded newer image for hello-world:latest

Hello from Docker!
This message shows that your installation appears to be working correctly.

To generate this message, Docker took the following steps:
 1. The Docker client contacted the Docker daemon.
 2. The Docker daemon pulled the "hello-world" image from the Docker Hub.
    (amd64)
 3. The Docker daemon created a new container from that image which runs the
    executable that produces the output you are currently reading.
 4. The Docker daemon streamed that output to the Docker client, which sent it
    to your terminal.

To try something more ambitious, you can run an Ubuntu container with:
 $ docker run -it ubuntu bash

Share images, automate workflows, and more with a free Docker ID:
 https://hub.docker.com/

For more examples and ideas, visit:
 https://docs.docker.com/get-started/

Prepare Offline Installation Files

Perform this step on a system with internet access.

# Create staging directories 
mkdir ~/virtru-CSE-offline 
cd ~/virtru-CSE-offline 

# Download setup and dependency files 
curl -s https://api.github.com/repos/virtru/cse-install-script/releases/latest \
| grep "browser_download_url.*sh" \
| cut -d : -f 2,3 \
| tr -d \" \
| wget -qi -

Once completed, you’ll have a file named virtru-CSE-offline-bundle.tar.gz containing:

• The setup-CSE-latest.sh installer

• Supporting setup scripts and configuration templates

Download and Save the Virtru CSE Container Image

The installer will not function offline unless the cse Docker image is also included.

Run the following on the connected machine (replace vX.X.X with the desired version): See release notes

# Pull the desired CSE image from Virtru's registry
docker pull containers.virtru.com/cse:vX.X.X

# Save the image to a tar archive for offline transfer
docker save --output cse:vX.X.X.tar containers.virtru.com/cse:vX.X.X

Example:

docker pull containers.virtru.com/cse:v5.9.2
docker save --output cse:v5.9.2.tar containers.virtru.com/cse:v5.9.2

Package for Transfer

Bundle everything into a single archive:

tar -czvf virtru-cse-offline-bundle.tar.gz deploy-cse-vX.X.X.sh cse:vX.X.X.tar

Example:

tar -czvf virtru-cse-offline-bundle.tar.gz deploy-cse-v5.9.1.sh cse:v5.9.2.tar

This archive now contains:

• setup-cse-latest.sh installer

• Required setup scripts

• The cse:vX.X.X.tar Docker image file

Transfer Files to the Offline Server

Use SCP, USB, or a secure transfer method to copy the offline bundle to your offline environment:

scp virtru-cse-offline-bundle.tar.gz user@<offline-server-ip>:/var/virtru/scripts

Extract Files and Load the Docker Image (Offline Host)

On the offline Linux server:

cd /var/virtru/scripts
tar -xzvf virtru-cse-offline-bundle.tar.gz

# Load the saved Docker image into the local Docker environment
docker image load -i cse:vX.X.X.tar

Confirm the image is available:

docker images

Expected output:

REPOSITORY                     TAG        IMAGE ID       CREATED         SIZE
containers.virtru.com/cse       vX.X.X     123abc456def   2 weeks ago     500MB

Remove Docker Images (Optional)

To remove a Docker image, you can use one of the following commands depending on your needs:

 Force Remove (if image is in use or has dependencies)

docker rmi -f <image_name_or_id>

Example:

docker rmi -f containers.virtru.com/cse:v5.9.2

To List All Images

docker images

 To Remove All Unused Images (Cleanup)

docker image prune -a

(Use with caution — this deletes all images not currently used by any container.)

Next Steps

Follow the Standard Online Install to complete the installation of the cse.

bash ./cse-setup-scripts/setup-cse-latest.sh -o true