Skip to main content
Domino provides methods to list all images used for installation, and these images can be copied to a local registry for installation in air-gapped environments without internet access to upstream image sources.

​
Prerequisites

​
Set up your environment for ddlctl

  1. Get the $FLEETCOMMAND_AGENT_TAG for your target release from the releases page.
  2. Use environment variables to set some values used by the ddlctl CLI. This simplifies the commands you’ll run while installing Domino components: 
    unset HISTFILE
export QUAY_USERNAME=<`quay.io` username provided by Domino>
export QUAY_PASSWORD=<`quay.io` password provided by Domino>
export FLEETCOMMAND_AGENT_TAG=<Tag that corresponds to the version of Domino deployed>

​
Generate the images list

Run the following: 
ddlctl images --agent-version $FLEETCOMMAND_AGENT_TAG -o json > images.json
The structure of the JSON is as follows: 
    [
      {
        "id": "some_image",
        "name": "quay.io/domino/some-image:some-tag",
        "registry": "quay.io",
        "repository": "domino/some-image",
        "tag": "some-tag"
      },
    ]

​
Copy the images

You can copy the images to your private registry in two ways, depending on whether your environment has network access to both the air-gapped environment and the internet for the duration of the copy.

​
Option 1: Generate a script to copy the images with Skopeo

If you have an environment with network access to both the air-gapped environment and the internet for the duration of the copy, you can generate a script to copy images with Skopeo.
  1. Run the following: 
    jq -r '.[] | "skopeo copy docker://\(.name) docker://my-registry/\(.repository):\(.tag)"' images.json > image-copy.sh
  2. This produces an image-copy.sh script with the following format: 
    skopeo copy docker://quay.io/domino/some-image:some-tag docker://my-registry/domino/some-image:some-tag
  3. Review the result and adjust the skopeo command as necessary for your situation.
  4. Run the script to copy images to your local registry: 
    bash image-copy.sh
Once the images have been loaded into your private registry, you’re ready to install Domino.

​
Option 2: Copy the images from tar files

The instruction above presumes that an environment exists with network access to both the air-gapped environment and the internet for the duration of the copy. If this is not the case, you can do a two-step copy, using local tar files as an intermediate step, and transport the tar files via some other means to bring them into the air-gapped environment. For example:
  1. Run the following: 
    jq -r '.[] | "skopeo copy docker://\(.name) docker-archive://some/local/path/\(.id).tar"' images.json > copy-to-tar.sh
jq -r '.[] | "skopeo copy docker-archive://some/local/path/\(.id).tar docker://my-registry/\(.repository):\(.tag)"' images.json > copy-from-tar.sh
  2. This produces:
    • A copy-to-tar.sh file with the following format: 
      skopeo copy docker://quay.io/domino/some-image:some-tag docker-archive://some/local/path/some_image.tar
    • A copy-from-tar.sh file with the following format: 
      skopeo copy docker-archive://some/local/path/some_image.tar docker://my-registry/domino/some-image:some-tag
  3. Then, on a system with internet, do the following:
    1. Execute copy-to-tar.sh to copy all images from Domino’s official registry to tar files.
    2. Copy the tar files (and copy-from-tar.sh file) to a disk within the air-gapped environment.
    3. Run copy-from-tar.sh to copy from the tar files to the private registry.
Once the images have been loaded into your private registry, you’re ready to install Domino.

​
Install Domino

After loading images into your private registry, create your configuration file with custom registry settings. Run ddlctl create config with the --offline flag and specify your registry URL: 
ddlctl create config --offline --agent-version ${RELEASE_TAG} --agent-repository "your-registry-url.domain:port/custom-repository" --image-registry "your-registry-url.domain:port" --username "your-username" --password "your-password"
If you’re using ddlctl version 0.4.4, you must specify dummy values for --username and --password when using the --offline flag. This requirement is removed in later versions.
If your registry requires authentication, verify the image_registries section in your generated configuration contains the correct credentials: 
helm:
  image_registries:
  - server: your-registry-url.domain:port
    username: '<username>'
    password: '<password>'
Helm charts come prepackaged within the fleetcommand-agent image that runs reconciliation jobs for the Platform Operator. No additional fields are required in the helm configuration object besides image_registries. With your configuration file ready, you can proceed with the installation as outlined in Install Domino.

​
Get the images list (optional)

To download a list of images contained in a Domino release: 
curl -u username:password -#SfLOJ https://mirrors.domino.tech/s3/domino-artifacts/offline/fleetcommand-agent-${RELEASE_TAG}/images.json
The JSON file contains key-value pairs of Domino versions and their associated images. To extract image names for a specific version using jq: 
jq -r '.["6.3.x"][].name' images.json