Offline and air-gapped
Talon Studio runs with no route to the internet: the image is self-contained and a Community key is checked on your own server. What needs arranging is getting the image in, and the handful of background jobs that fetch public content.
What works offline
One container holds the app, Postgres and the pySigma sidecar, and the kokoro container beside it carries its own voice model, so authoring, translation, validation against your SIEM, change requests, Git history and deploys to a SIEM inside your network all run without the internet. A Community key never contacts Talon Labs; the one default call to talonlabs.dev is the update check. What reaches out by default is listed below, with the switch for each.
Bring the image in
On a machine that can reach the registry, save the pinned release to a file; carry it across; load it:
The compose file also runs kokoro, the assistant's voice, from its own image: save and load it the same way, by the name on the compose file's kokoro image: line, or delete that service and set TALON_TTS_URL= (empty) in .env, and the browser's own voice reads replies.
Verify the signature on the connected side before you save it (Install → Pull the image). For Kubernetes, push the image to your internal registry and set image.repository in the chart; the chart itself is two files from /charts you can carry across the same way.
The key
A Community key is verified against the public key inside the image — no call anywhere. Paste it as usual, or set TALON_LICENSE_KEY. Set TALON_LICENSE_API_URL= (empty) and the appliance makes no licence call whatever key it holds; with TALON_DISABLE_UPDATE_CHECK=true as well, it makes no call to Talon Labs at all. An Enterprise key then needs Activate offline on your Talon Labs account — see Licensing.
Content and threat intelligence
A sync that cannot reach its source only logs and retries; nothing fails because of it. Switching them off keeps the logs quiet and the detailed health from reading degraded.
AI
Claw and the other agents need a model. Offline, that is a model server inside your network — Ollama, vLLM or any OpenAI-compatible gateway — added as an AI connection in the app, with TALON_ALLOW_PRIVATE_AI_BASE_URLS=true so a private address is accepted (TALON_LLM_GATEWAY_URL works too). The local embedding model behind the knowledge features is fetched on first use; offline, add an embedding connection to a model server inside your network, or turn the local one off with DISABLE_LOCAL_EMBEDDINGS=1. The search reranker is fetched the same way; without it, search keeps the order it found, and TALON_RERANK=off stops it trying.