Private registries & restricted networks

Run the StackRadar scanner in clusters with private container registries or restricted egress: mirror the chart and image, configure a proxy, and allow the single API endpoint the agent needs.

Many clusters can't pull from public registries or have tightly filtered egress. This guide covers the three patterns that make the StackRadar scanner work there: mirroring the chart and image into your own registry, routing through an egress proxy, and allowlisting the one endpoint the scanner needs.

StackRadar's dashboard is a managed service, so a fully air-gapped cluster (zero outbound connectivity, ever) can't report scan results. The scanner needs one outbound path: HTTPS to api.stackradar.io. Everything else — the chart, the image, all image pulls — can come from inside your network.

What the scanner needs, exactly

Requirement	Can be internal?
Helm chart (`stackradar-scanner`)	Yes — mirror to any OCI registry or internal chart repo
Scanner container image	Yes — mirror to your private registry
SBOM uploads & heartbeats — HTTPS to `api.stackradar.io`	No — allowlist directly or route via egress proxy

Notably, the scanner does not need to download a vulnerability database into your cluster. Vulnerability matching happens server-side against StackRadar's continuously synced OSV.dev mirror, so there is no nightly feed download to allowlist and no stale in-cluster database to maintain. See how vulnerability matching works.

Mirroring the chart and image

Check the current chart version and default values on Artifact Hub, then pull the chart from the public OCI registry on a connected machine:

bash

helm pull oci://ghcr.io/lockdep/charts/stackradar-scanner

Push the resulting .tgz to your internal registry (any OCI-compliant registry works — Harbor, ECR, Artifact Registry, ACR, Nexus):

bash

helm push stackradar-scanner-<version>.tgz oci://registry.internal.example.com/charts

Mirror the scanner image the same way you mirror other public images (e.g. with crane copy, skopeo copy, or your registry's proxy-cache feature). List the chart's default image references and configurable values with:

bash

helm show values oci://ghcr.io/lockdep/charts/stackradar-scanner

Then install from your internal registry, overriding the image repository values shown by helm show values to point at your mirror:

bash

helm install stackradar-scanner \
    oci://registry.internal.example.com/charts/stackradar-scanner \
    --namespace stackradar --create-namespace \
    --set stackradar.apiKey=$STACKRADAR_API_KEY \
    --set stackradar.clusterId=$STACKRADAR_CLUSTER_ID \
    --values internal-registry-overrides.yaml

Restricted egress

Firewall allowlist — allow outbound HTTPS (TCP 443) to api.stackradar.io. No other StackRadar endpoint is contacted by the scanner.
Egress proxy — the scanner respects standard proxy environment variables. Set HTTPS_PROXY (and NO_PROXY for in-cluster traffic) via the chart's environment values.
NetworkPolicy — if you default-deny egress in the stackradar namespace, add a policy permitting DNS and HTTPS egress for the scanner pod.

What actually leaves the network

Uploads are CycloneDX SBOM documents: package names, versions, and identifiers (PURLs) for each container image, plus cluster/workload metadata so results are attributable. No source code, no environment variables, no secrets, and no image contents are transmitted — and all data is stored in the EU. Details in architecture & data flow.