Last updated: 2026-11-02
Purpose
This document explains the ownership and maintenance responsibilities for supported On-Premise Scanning deployments.
Introduction
The On-Premise Scanning platform is built on a split-ownership model that assigns the ownership and maintenance of certain components to the owner of the deployment and others to Outpost24. As a general rule, the owner of the deployment is responsible for all software that is not delivered by Outpost24.
While On-Premise Scanning technically can be deployed on any operating system, the supported platform is Debian, which is what is used in all the Outpost24 provided installation media (See On-Premise Scanning Installation). This document describes the architecture and ownership based on deployments that follow the supported deployment options.
Ownership and architecture can be described on a few different levels, and they will be described independently
-
Virtual machine
-
Software running on virtual machine
-
Software running on Kubernetes cluster
Virtual machine
The virtual machine is owned by the user and not by Outpost24. Outpost24 sets requirements on the virtual machine, but it is up to the customer to make sure it is configured correctly.
Anything outside of the VM has little impact on the software that Outpost24 is responsible for, but networks that require an air-gapped deployment or proxy configuration will require special configuration by the user to work properly.
Software running on virtual machine
Outpost24 provides installation utilities and media to make On-Premise Scanning work on the Debian operating system. The Debian operating system itself is owned by the user, but some specific software running on the Debian machine will be lifecycled by Outpost24 as part of the different supported update mechanism.
The visualization to the right indicates some example services that shows the split between Outpost24 and user responsibilities.
The user will be responsible for making sure that the system is updated according to their maintenance requirements.
Outpost24 will provide a mechanism to make sure that the services that Outpost24 relies on, like K3s and others, have an upgrade path as well.
Baseline Debian system
The baseline for the appliance is a Debian system that comes with all the pre-installed software generally associated with a minimal Debian system. The user is expected to keep the Debian software updated and might have to update when On-Premise Scanning relies on new OS level software.
Software running in K3s
All software running within the K3s cluster is delivered by Outpost24 and Outpost24 is responsible for the update path of everything running in there.
Outpost24 installed software
|
Software |
Used for |
Reference |
|---|---|---|
|
K3s |
Kubernetes cluster |
|
|
Zot registry |
Storage of container images required to do local copy of images |
|
|
On-Premise Scanning bootstrap utility |
Utility developed by Outpost24 to alleviate some configuration tasks for OPS, including enrollment. |
How it fits together
The diagram below shows an abstract overview of how the high level
In an air-gapped deployment, the update procedure that would otherwise connect to the Outpost24 cloud, would involve the operator to do an out of bounds update package transference. See Update Air-Gap On-Premise Scanning Deployment for Air-Gap update instructions.