Air-gapped installs

Sail works without internet access. It never calls Msty, sends no telemetry, and loads nothing from outside: fonts, scripts and the built-in assistant templates are all inside the image.

All Sail needs is your identity provider and your Nexus, on the same network.

What has to be reachable

	Why
Your identity provider	Signing people in, and the hourly access check
Your Nexus	Every model call, plus web search and tools
Your people’s browsers	To use Sail

Models themselves can run inside your network too, served through Nexus. Web search needs Nexus to reach a search provider, so on a fully closed network, turn Web search off in Policies.

Bring the images in

On a machine with internet access, pull and save the images:

docker pull ghcr.io/cloudstack-llc/msty-sail:1.4
docker pull postgres:18
docker pull caddy:2.10
docker pull alpine:3.22
docker save ghcr.io/cloudstack-llc/msty-sail:1.4 postgres:18 caddy:2.10 alpine:3.22 -o sail-images.tar

alpine:3.22 is used by the backup and restore scripts. Skip caddy:2.10 if you use your own HTTPS proxy.

Carry sail-images.tar and the release bundle across, then load the images on the server:

docker load -i sail-images.tar

Then follow Install with Docker Compose as usual.

Certificates

The bundled Caddy normally gets a certificate from Let’s Encrypt, which needs the internet. Without it, bring your own:

1. Put cert.pem and key.pem in the tls folder next to compose.yaml.
2. In the Caddyfile, add tls /tls/cert.pem /tls/key.pem inside each site block.

If your identity provider or Nexus uses a certificate from your own certificate authority, Sail must trust it. See Trust a private certificate authority.

Private addresses

Your identity provider and Nexus most likely have private addresses. Sail refuses those unless you allow them:

SAIL_OUTBOUND_ALLOW=login.internal,nexus.internal

Upgrades

Same as any upgrade, with the image carried across: save the new version on a connected machine, load it on the server, change SAIL_IMAGE, and restart. See Upgrades.

What doesn’t work offline

• Web search, unless Nexus can reach a search provider.
• Links in answers to outside websites, which open in people’s browsers and need internet there.