TL;DR
- Airlock Depot 0.1.6 carries the Broadcom/VMware VCF depot across an air gap: a connected appliance syncs and scans, a dark-site appliance serves SDDC Manager, VCF Operations and VCF Installer.
- One full-depot package moved 526,681,108,716 bytes across 12,957 files, verified independently on the dark side in about 38 minutes and published atomically: 12,957 new, 0 replaced.
- Then the deltas get small. The first one was 9 files and 88 MB.
- Every package carries a signed manifest that doubles as an SBOM: every file, size, SHA-256, scan attestation, signing identity.
- Transfer is one-way. Nothing but a human-typed summary code goes back the other direction, and no telemetry leaves either appliance.
The problem with offline depots
VCF expects the internet. SDDC Manager, VCF Operations and VCF Installer all want a depot to pull from, and their offline settings accept a host, a port, a username and a password. There is no path field and no file import. So in a real air gap you end up hand-carrying loose files, guessing at directory layouts, and hoping nothing changed in transit. No signature, no manifest, no scan record, nothing to show an assessor.
Airlock Depot is two appliances that turn this into a workflow. The connected appliance sits on the internet side, syncs the depot and scans it. The dark-site appliance sits inside the gap, verifies what arrives and serves it. Between them go signed, chunked packages on removable media.
The first crossing is big. The rest are not.
The full depot moved as one package: 526,681,108,716 bytes, 12,957 files, a single NVMe chunk. It was malware-scanned at build time, with the scan attestation embedded in the signed manifest. That embedding matters more than it sounds. An unscanned delta cannot be signed, and there is no override flag to make it happen. The dark side then verified the package independently, taking about 38 minutes, and published it atomically: 12,957 files new, 0 replaced.
After that, the interesting number is the small one. The first delta package was 9 files and 88 MB, riding on that base. It carried the depot metadata, the manifest and product version catalog and compatibility data, which is what lets consumers bootstrap in the first place. Built, verified and published the same day. A real SDDC Manager then connected to the dark depot over HTTPS with basic auth and pulled that metadata: 200, 214,215 bytes for vcfManifest.json. That is the whole point of the exercise, and it is a fairly boring log line, which is how you want it.
An air gap you can audit
The signed manifest is the part your assessors will care about. It lists every file with its size and SHA-256, the scan attestation, the ed25519 signing identity, and the totals. It is an SBOM in the sense that matters here: a complete, signed statement of what is in this package. It is persisted with every export and every import, and it is one click in the GUI to view or download, including from the operator confirmation dialog, where the question is literally “what left this node.”
Verification on the dark side is all or nothing. Signature, every file hash, scan attestation. If any of it fails, the whole package is refused. There is no partial import and no unverified file quietly landing in the depot.
The other direction is covered too. Observed consumers shows every client actually pulling from the depot, per IP and user, with first and last seen, bytes transferred, and a health read: serving, some 404s, or denied. It comes from a dedicated access log rather than a registry, so it reflects what is really happening instead of what someone remembered to register. Between the manifest and that view, you can account for every byte in both directions without asking anyone to take your word for it.
Built for classified networks
A few things exist specifically because of where this runs.
The transfer is one-way. Packages go high side only. The confirmation that closes the loop on the connected appliance is a summary code read off the dark appliance and typed in by a cleared operator. There is no low-to-high data path to argue about, because there is no data path at all.
Classification banners. An appliance-wide setting puts a band top and bottom of every screen, including sign-in: UNCLASSIFIED in green, SECRET in red, TOP SECRET in yellow, TOP SECRET//SAP in purple, plus a free-text caveat field for things like //NOFORN. The colour table is deliberately one line of code, so a site whose marking guide differs can match it exactly rather than argue with us about it.
Real media profiles. Chunking is keyed to actual capacities: LTO-9 at 18 TB, removable NVMe at 2 TB, BDXL at 100 GB, Blu-ray at 50 and 25 GB, DVD at 8.5 and 4.7 GB. Write-once media is flagged as such, because a package that assumes it can rewrite a disc is a package that fails at 3 a.m.
No telemetry. Nothing leaves either appliance. Not usage data, not crash reports, not a licence check.
The unglamorous parts
Storage reclaim knows which package copies the appliance still needs, the ones awaiting confirmation or pending publish, and which it does not. It deletes only the latter, and it never touches removable media. That is a deliberate boundary: the appliance manages its own disk, and your media stays yours.
The pre-flight card runs first-boot network checks with per-check detail and a one-line re-run: DNS in both directions, gateway, NTP, and on the connected side the Broadcom endpoints. It is the difference between “setup failed” and knowing that reverse DNS is the thing that is broken.
Where it is
Airlock Depot 0.1.6 works with VMware Cloud Foundation 9.1 and serves SDDC Manager, VCF Operations and VCF Installer as ordinary depot consumers. It is in early access and active field hardening, which is an honest way of saying the numbers above come from real runs and there are more of them to do.
More at tools.virtualbytes.io.
