---
sidebar_position: 2
title: On-premises and air-gapped deployment
sidebar_label: On-premises & air-gapped
description: Run all of Myop on your own hardware inside a closed network — one Docker image, delivered offline, with no internet access and no outbound traffic at runtime. For banks, government and other regulated environments.
keywords: [myop on-premises, air-gapped deployment, offline docker image, closed network ui platform, on-prem component platform, regulated industries, bank, government, no internet dependency]
---
# On-premises and air-gapped deployment

Some organizations cannot let any runtime traffic leave their network: banks, government, defense, and
anyone whose development and test environments are disconnected from the internet. For them, Myop runs
**entirely on their own hardware**, inside the closed network, with no connection to Myop or to the
internet.

## One image, delivered offline

All of Myop ships as **a single Docker image** that runs as **one container**.

```
Myop                      build the image, docker save | gzip
                                        │
                              one file: myop-enterprise.tgz
                                        │
═══════════ air gap ═══════  moved through your approved transfer channel
                                        │
Your closed network       docker load, then docker compose up -d
```

- **No public registry.** You receive one file and load it with `docker load`. Nothing is pulled at
  install time or at runtime.
- **No source code on your side.** You receive a built artifact only.
- **The same image everywhere.** The image you run in DEV and UAT is the one you promote to production,
  so environments don't drift.

## What runs inside

| Service | What it does |
|---|---|
| **Component registry and API** | Stores components and serves them to your applications at runtime |
| **Dashboard** | Manage components, environments and releases |
| **Component Builder** | Build and edit components, inside the same container |
| **Private npm registry** | Serves the Myop packages your developers install, preloaded from the image |
| **Docs** | The documentation, available offline |
| **Status page** | Health of every service at a glance |

Your host applications load components from the in-network registry exactly as they would from the
Myop cloud. Release a new version in the dashboard and your app picks it up on its next load, with no
rebuild and no redeploy.

## Security model

- **Nothing listens on the network directly.** Every service binds to `127.0.0.1`. The only way in is
  your own reverse proxy, with your TLS.
- **No outbound traffic.** Every dependency is inside the image, so the system runs fully disconnected.
- **Your data stays on a volume you control.** Registry and package data live on a dedicated Docker
  volume, separate from the image. The image itself never changes.

## Operations

| Task | How |
|---|---|
| Install | `docker load < myop-enterprise.tgz`, then `docker compose up -d` |
| Check health | `docker ps`, or open the status page |
| Upgrade | Load the new image, recreate the container. Your data volume is kept |
| Survive reboots | The container restarts automatically (`restart: unless-stopped`) |

## Is this for you?

On-premises deployment is set up together with your platform and security teams, and we deliver an
architecture brief for your review. If you run a closed or regulated network,
[book a technical intro](https://calendly.com/hadar-myop/myop-technical-intro).

If you only need to serve components from your own CDN while managing them in the Myop cloud,
[self-hosting](/docs/self-hosting) is the lighter option.