Air-gapped by design: AI caching where the internet isn't invited
No phone-home, offline license verification, one binary. The deployment story for networks that treat outbound packets as incidents.
Air-gapped and egress-restricted environments run a brutal vendor filter: cloud control planes, online license checks, telemetry beacons, and package-manager installs all die at the firewall. Most modern AI tooling fails the filter in the first paragraph of its own docs, the architecture assumes a chatty relationship with the vendor.
Crowkis assumes silence. The binary is self-contained; the license verifies with a local Ed25519 signature check against a baked-in public key, our servers are not consulted, ever; there is no telemetry to disable because none exists; and the dashboard, metrics, and full intelligence stack run entirely within the gap. Install media is one image file you carry in.
- 1one stripped Rust binary
- 2/data volume
- 3non-root user
- 4no Python · no PyPI
- 5no package manager
- 6no dependency tree
One file to security-review. No supply chain to poison.
The workload fit is stronger inside the gap, not weaker: constrained or accredited inference capacity makes every avoided model call precious, and the fixed-corpus analyst workloads typical of these environments are repetition engines. Sub-millisecond hits stretch scarce compute exactly where procurement cycles can't.
The bottom line
Most vendors retrofit an 'offline mode' as a sales checkbox. Offline is our only mode, the connected deployment is just the air-gapped one with friendlier neighbors.