Sealing and Egress

Audience: operators sealing a Stella Ops deployment for air-gapped or constrained-egress operation.

Purpose: lock down and verify outbound network access so a sealed deployment cannot reach external endpoints, and capture the result as release evidence.

Sealing enforces the platform’s offline-first posture: once a deployment is sealed, services must not be able to egress to external networks. Stella Ops ships the tooling to apply and verify these controls in devops/offline/airgap/.

Supported Scope

Sealed-mode egress controls are supported for Docker Compose and host networking through the air-gap tooling in devops/offline/airgap/.

Kubernetes NetworkPolicy guidance is retired: Stella Ops targets self-hosted, non-Kubernetes container estates and does not support Kubernetes deployments.

Checklist

  1. Apply compose-egress-guard.sh to the approved Compose network.
  2. Run verify-egress-block.sh docker <network> <output.json>.
  3. Store the JSON output and the host firewall state in the release or sealed-mode evidence pack.
  4. Re-run verification after any Compose profile, host firewall, or registry-mirror change.

Unsupported Legacy Paths

Do not apply Kubernetes NetworkPolicies, use pod probes, or run kubectl verification for a Stella Ops sealed-mode deployment. These paths are unsupported and produce no valid sealed-mode evidence.