Skip to main content
Prepare runtime files, SDK packages, and images on a connected machine, then transfer them to employee devices.

​
Provision the runtime

Package matching msb, libkrunfw, and SDK dependencies for each target OS and architecture. Preserve the release’s executable permissions and library links. Follow runtime setup and use managed paths if you install the runtime in a shared location. Install application dependencies before disconnecting. Setup helpers can download missing or mismatched runtime files; Go provides WithSkipDownload() to require an existing installation. Use your device manager to distribute approved runtime packages and managed settings. Package runtime dependencies separately from the policy file and verify them in the employee’s context.

​
Transfer approved images

On a connected machine with the same CPU architecture as the target, pull and export an image. This example uses Alpine; substitute your approved image:
Transfer the archive through your distribution system. On the employee device, confirm msb context selects the local backend, then import it as the employee who will run sandboxes:
Load into the same configured home and cache used by the application. Image export can change manifest and layer digests, so use the imported reference rather than assuming the original digest is preserved. See image archives.

​
Verify without downloads

Disconnect public network access, run msb doctor, and test the imported image:
--pull never fails if the image is unavailable locally. --no-net disables guest networking; it does not control host installer downloads. This unnamed sandbox is removed when the command finishes. Repeat with your actual application and SDK. Include every image, package, and runtime dependency it needs, then distribute updates through the same process.