> For the complete documentation index, see [llms.txt](https://docs.envector.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.envector.io/1.4.x/get-started/installation/on-premise-installation.md).

# Secure Installation Guide

> Install enVector on customer-managed, air-gapped infrastructure. **Prerequisite**: the delivery bundle (`airgap-bundle/`) is already on the target server.

## 1. Requirements

* **OS**: Linux x86\_64 / arm64 (Ubuntu 20.04+, RHEL 8+)
* **CPU / Memory / Disk**: 16 cores, 32 GB RAM, 256 GB SSD
* **Python** (for SDK): 3.9 – 3.13
* **License**: License token (for running `enVector`)
* **Runtime**: Docker ≥ 27.3 + Compose v2.27, **or** Kubernetes 1.24+ with Helm 3

| Use Case                      | Method                     |
| ----------------------------- | -------------------------- |
| Single-node PoC / lab         | **Docker Compose** (§3)    |
| Production, HA, GPU scale-out | **Kubernetes + Helm** (§4) |

Pick one and follow it end-to-end.

## 2. Bundle Layout

```
airgap-bundle/
├── envector-images.tar      # container images
├── sdk-wheels/              # Python SDK wheels
├── token.jwt                # license token
├── docker-compose/          # compose manifests + start_envector.sh
└── helm-chart.tgz           # Helm chart (if needed)
```

***

## 3. Docker Compose

```bash
# 1. Load images
docker load -i envector-images.tar

# 2. Configure
cd docker-compose
cp .env.example .env
# Edit .env — PULL_POLICY=never is REQUIRED in air-gapped envs
cp /path/to/token.jwt ./token.jwt

# 3. Start
./start_envector.sh

# 4. Verify
docker compose -p envector ps
```

> ⚠️ `PULL_POLICY=never` must be set, otherwise Docker will try to pull from the public registry and fail.

***

## 4. Kubernetes (Helm)

```bash
# 1. Distribute images — push to internal registry, or load on each node
docker load -i envector-images.tar

# 2. Configure values
cp kubernetes-manifests/helm/values.yaml values-airgap.yaml
# Edit: image.repository, tag, pullPolicy: Never
```

```yaml
endpoint:
  image:
    repository: registry.internal.example.com/envector/envector-endpoint
    tag: "<VERSION_TAG>"
    pullPolicy: Never
backend:
  image:
    repository: registry.internal.example.com/envector/envector-backend
    tag: "<VERSION_TAG>"
    pullPolicy: Never
orchestrator:
  image:
    repository: registry.internal.example.com/envector/envector-orchestrator
    tag: "<VERSION_TAG>"
    pullPolicy: Never
shaper:
  image:
    repository: registry.internal.example.com/envector/envector-shaper
    tag: "<VERSION_TAG>"
    pullPolicy: Never
compute:
  image:
    repository: registry.internal.example.com/envector/envector-compute
    tag: "<VERSION_TAG>"
    pullPolicy: Never
  license:
    enabled: true
    createSecret: false
    existingSecret: envector-license
```

```bash
# 3. Create namespace + license Secret
kubectl create namespace envector
kubectl create secret generic envector-license \
  --from-file=token.jwt=/path/to/token.jwt -n envector

# 4. Install
helm install envector airgap-bundle/helm-chart.tgz \
  -f values-airgap.yaml -n envector

# 5. Verify
kubectl get pods -n envector
```

> For internal registries requiring auth, also create an `imagePullSecret` named `regcred`.

***

## 5. Verify

```bash
# Install SDK from bundled wheels
pip install --no-index --find-links=./sdk-wheels/ pyenvector
```

```python
import os, pyenvector as ev
ev.init_connect(
   address="localhost:50050",
   access_token="ACCESS_TOKEN_IF_NEEDED",
)

from pyenvector.crypto import KeyGenerator
keygen = KeyGenerator("./keys", eval_mode="mm32")
keygen.generate_keys()
```

If `init_connect` and `generate_keys` succeed, the installation is complete.

***

## Troubleshooting

* **Image pull errors** — verify `PULL_POLICY=never` (Compose) / `pullPolicy: Never` (Helm) on every component.
* **License token not found** — check the `envector-license` Secret with `kubectl describe pod -n envector`.
* **Out of memory** — FHE workloads need ≥ 32 GB free; check with `free -h`.
* **Disk full on image load** — clean up with `docker system prune` or `crictl rmi`.

***

> ➡️ Next: see the [**User Guide — Initialize**](/1.4.x/sdk-user-guide/initialize.md) for enrollment and search.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.envector.io/1.4.x/get-started/installation/on-premise-installation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.