Skip to content

Deploy workshop · 7 chapters · 100 minutes

Ship it to the island.

Your customer runs everything in a network with no internet. Get Parrot there: catch the calls it makes home, seal it in a crate, beat the pirates on the ferry, bring its dependencies, run it with no network at all, and roll it back.

  • Air-gapped VPC
  • Egress
  • Reproducible builds
  • Signing
  • Hashed wheels
  • docker save
  • Rollback
Start the workshopView the code
mainland to islandreal output, trimmed
$ ferry guard parrot --selftest
BLOCKED telemetry.parrot.example:443
BLOCKED updates.parrot.example:443
$ ferry send --pirates && ferry land
REJECTED parrot/server.py does not match the manifest
$ ferry send && ferry land
seal ok, 16 of 16 files match, current -> 1.0.1
$ ferry run --selftest
parrot says "Who's a pretty deploy?"
gap guard: nothing tried to leave

What you run and read

The applab/parrot/A notice board that calls home three ways.
The guardlab/ferry/guard.pyBlocks every call that would leave.
The cratelab/ferry/crate.pySealed, hashed, the same bytes every time.
The islandlab/ferry/island.pyReleases that never change, and rollback.

7 short chapters

Each one is a few minutes of reading, one thing to run or break, and an exercise. By the end you know what an island customer will ask, and you have an answer for each.

  1. 01Welcome to the island10 min
  2. 02Catch the phone-homes15 min
  3. 03Pack the crate15 min
  4. 04Cross the gap15 min
  5. 05Bring your dependencies15 min
  6. 06The real gap, in Docker15 min
  7. 07Updates, rollback and the VPC checklist15 min

Run it in a minute

You need uv and git. You will see Parrot try to call home, and the guard stop it. Docker is only needed for chapter 06.

git clone https://github.com/jars-demo/air-gap-demo.git
cd air-gap-demo/lab
uv sync
uv run python -m ferry guard parrot --selftest