Airgapped Deployment

Run Droid inside an isolated network with no outbound internet connectivity, using your own model endpoints, settings, and collectors.

Droid ships in a dedicated airgap build for networks that have no route to the public internet. The build runs the full agent harness locally and contacts only endpoints you configure. This page describes how Airgap Mode behaves, the network contract it follows, and what to configure across a fleet.

For choosing between cloud-managed, hybrid, and airgapped patterns, see Deployment Patterns.

Info

Airgap builds are an enterprise capability and are not distributed through the public download channels. Contact Sales or your Factory representative for access, then import the binaries through your own artifact repositories.

How Airgap Mode behaves

Airgap builds run in Airgap Mode automatically. In this mode, Droid:

Skips sign-in. There is no login flow and no Factory account requirement; identity stays local to the machine.
Offers your models only. The model picker lists the custom models from your settings and nothing else. Factory-managed models and the Factory Router are unavailable; all inference goes to the endpoints you configure through BYOK.
Skips Factory-bound work. Update checks, release-notes fetches, session sync, crash reporting, and Factory telemetry are all disabled rather than left to time out.
Reads policy from your sources. Org policy comes from the system-managed settings file or a managed-settings endpoint you host inside the network.
Exports telemetry to your collector only. With no collector configured, the telemetry pipeline does not run. See Airgapped deployments in Telemetry & Analytics.

Warning

An airgapped installation needs at least one custom model. Without one, Droid refuses to start a turn and asks you to configure a custom model in settings.json.

Network behavior

Network contract

In airgapped operation, Droid makes no requests to Factory-operated services during interactive and headless (droid exec) use: no Factory API, LLM proxy, telemetry ingest, crash reporting, update checks, release-notes fetches, documentation lookups, or login services. The outbound traffic in an airgapped session is the traffic your configuration creates.

Destinations Droid uses

Destination	Where the address comes from
Model endpoints	`customModels[].baseUrl` in your settings
MCP servers	Your user or org MCP configuration
Git remotes	The repositories you work in
Managed-settings endpoint	An org configuration URL you host (optional)
OTEL collector	`telemetry.endpoint` in managed settings
Plugin marketplaces	Marketplace sources in your org or user settings
Commands the agent runs	The agent's Execute tool, bounded by your sandbox network policy

Enforcement layers

Airgap Mode is a reliability contract, not an enforcement mechanism. The agent can run arbitrary commands, and an in-network gateway looks the same as a public API to the harness, so isolation must come from your infrastructure:

Layer	Owner	Guarantee
Network isolation	You	The boundary. Holds regardless of how any software inside it behaves.
Sandbox network policy	You configure it, Factory ships it	Kernel-enforced egress rules for commands the agent runs.
Airgap Mode	Factory	Cooperative. Droid skips Factory-bound work and stays reliable offline.

Note

Keep your firewall and sandbox rules scoped to the destinations in the table above. Droid does not need any other egress to operate.

Feature availability

Unavailable in Airgap Mode

Features that depend on Factory cloud are unavailable in airgapped deployments:

Factory account, billing, and usage-limit management
Session sharing and cross-device session sync
Slack integration
Agent readiness reports
Bug-report upload
Built-in web search and URL-fetch tools
In-product release notes
Automatic updates: import new builds through your artifact process instead
Factory-hosted analytics: use OTEL export to your own stack

Everything local works as in connected deployments: the full agent loop and tools, missions, specification mode, hooks, MCP servers, and installed plugins and skills, with all model traffic going to your endpoints.

Fleet configuration

Configuring an airgapped fleet

System-managed settings.json: Drop org policy at the hardcoded platform path so it applies before any user session, with no Factory connectivity required. See Enterprise Controls & Managed Settings.
Custom models: Ship customModels entries in managed settings. Org-distributed models use a keyless endpoint or apiKeyHelper rather than static keys.
Telemetry: Pin telemetry.endpoint to your in-network collector in managed settings. See Telemetry & Analytics.
Proxies and custom CAs: Standard proxy variables and custom CA trust apply to in-network endpoints. See Deployment Patterns.

Related resources

Deployment Patterns

Choose between cloud, hybrid, and airgapped patterns.

Custom Models (BYOK)

Configure the custom models an airgapped install requires.

Telemetry & Analytics

Export metrics to your own collector.

Enterprise Controls & Managed Settings

Distribute policy through the system-managed settings file.