FDE Times: Zarf packages a whole Kubernetes app into one file for clusters with no internet
A 5 November FDE Times tools guide covers Defense Unicorns’ Zarf for air-gapped banks, factories and defence clusters: zarf package create bundles images, Helm charts and config with an SBOM, zarf init then deploy on the disconnected side, and the usual failures are a missing sidecar image, skipping init, or dropping the SBOM before security review.
On air-gapped Kubernetes clusters—common at banks, factories and defence sites—a normal helm install fails on the first image pull. FDE Times’ 5 November tools guide walks FDEs through Zarf, the Apache-2.0 tool from Defense Unicorns (with roots at the Naval Postgraduate School / US Navy) that collapses many piecemeal transfers into one checked archive.
On a connected machine, a zarf.yaml lists every image, chart and manifest; zarf package create loads components, collects images, generates an SBOM unless you skip it, and writes one file. On the disconnected side you run zarf init first on a fresh cluster, then zarf package deploy. Packages can also come from an OCI registry with signature verification via --key.
The “bring everything” model is the main risk: forget one sidecar or subchart and you rebuild and re-approve the whole transfer. Before the file leaves the connected side, FDE Times recommends deploying to a kind cluster with outbound internet blocked, putting init in the customer runbook, and keeping the SBOM/signature for the security review—minutes saved at build time often cost days of approval later.
For interviews and CVs, pair Zarf with solid Helm/OCI basics, and describe packaging a real app, deploying it offline, and handing the SBOM to security—not just “knows Zarf.”
Source: fdetimes.net