Skip to content

Capsailer

Capsailer gets container images and Helm charts into Kubernetes clusters that have no internet access.

The problem

An air-gapped cluster cannot pull nginx:1.25 from Docker Hub, and the Helm charts you install still point at those public images. You have to download everything on a connected machine, carry it across, put it in a registry the cluster can reach, and change every image name to match. Doing that by hand is slow and easy to get wrong.

How Capsailer helps

 connected machine                          air-gapped side
┌──────────────────────┐   copy file    ┌─────────────────────────────────────┐
│ manifest.yaml        │  ───────────►  │ capsailer push                      │
│ capsailer build      │  bundle.tar.gz │   images ──► your registry          │
│  images + charts     │                │   charts ──► ChartMuseum (optional) │
│  names rewritten     │                │ helm install                        │
└──────────────────────┘                └─────────────────────────────────────┘
  1. Build: list images and charts in a manifest. capsailer build downloads them into one bundle file and can rewrite the image names inside the charts to point to your registry.
  2. Push: capsailer push uploads the images to a registry. Use one you already have (Harbor, Artifactory, registry:2), or let capsailer registry deploy one in your cluster.
  3. Install: run helm install. The charts already ask for the names that now exist in your registry.

Why use it

  • One binary. Building bundles and pushing images need no Docker, skopeo or other tools.
  • Names that match. build and push follow one naming rule, so the names in the charts are the names in the registry.
  • Works with the registry you have. Push to any registry with --external-registry, including with a path prefix like harbor.example.com:5000/nai.
  • Handles vendor tarballs. A docker save file with many images and short names like nutanix/nai-api:v2.8.1 can be pushed as it is.
  • Safe to preview. --dry-run prints every source -> destination before anything is uploaded.

Where to go next