Skip to content

Deploy: Private Appliance

Release binding: v0.1.0-enterprise-ready · 2026-05-19 · Signed release bundle, offline license

HX-SDP is currently available through a Private Appliance or scoped pilot. Contact HolonomiX to agree the target, release bundle, validation criteria, and commercial terms. The Private Appliance packages the signed runtime for customer-controlled infrastructure. Every path below starts from the supplied signed release bundle and ends with a validation report; the release claim is valid only after the target report passes without live patching. Use only the package and target included in your agreed release.

Supported targets

Target Status
VMware OVA on supported NVIDIA GPU hosts Supported
KVM, Proxmox, and OpenStack QCOW2 on supported NVIDIA GPU hosts Supported (OpenStack QCOW2 may remain gated until OpenStack GPU validation is present in the release dossier)
Air-gapped OCI Runtime Kit on supported NVIDIA GPU Kubernetes nodes Supported

Not supported: unmanaged consumer Windows hosts, non-NVIDIA GPU paths, public unauthenticated self-service, customer-modified base images, and unvalidated hypervisor or container runtime combinations.

Before any target: verify the bundle

Verify the signed release bundle first. See Release Verification.

sha256sum -c manifests/artifacts.sha256
hx-sdp release verify-signature \
  --file manifests/artifacts.sha256 \
  --public-key manifests/release-pubkey.pem \
  --signature manifests/artifacts.sha256.sig

VMware vSphere (OVA)

For VMware ESXi or vCenter clusters with NVIDIA vGPU or PCIe passthrough.

  1. Verify the release bundle.
  2. Import images/hx-sdp-vsphere.ova into vSphere.
  3. Attach the required GPU profile or passthrough device.
  4. Attach persistent storage for /var/lib/hx-sdp if the sizing plan requires it.
  5. Boot the VM and read the first-boot console report.

Validate:

hx-sdp gpu-preflight
hx-sdp validate --mode smoke --allow-missing-gpu=false

KVM and Proxmox (QCOW2)

For KVM, Proxmox, or equivalent private virtualization with NVIDIA PCIe passthrough. IOMMU must be enabled on the host and the GPU bound for passthrough.

qemu-img info images/hx-sdp-kvm.qcow2
virt-install \
  --name hx-sdp \
  --memory 32768 \
  --vcpus 16 \
  --disk path=images/hx-sdp-kvm.qcow2,format=qcow2,bus=virtio \
  --import \
  --os-variant ubuntu24.04 \
  --network bridge=br0,model=virtio \
  --graphics none

Attach the GPU passthrough device through your host policy before workload validation, then run hx-sdp gpu-preflight and hx-sdp validate --mode smoke.

OpenStack (QCOW2)

For OpenStack clouds with NVIDIA passthrough or vGPU scheduling already configured.

openstack image create hx-sdp-openstack \
  --disk-format qcow2 \
  --container-format bare \
  --file images/hx-sdp-openstack.qcow2

openstack server create hx-sdp \
  --image hx-sdp-openstack \
  --flavor <gpu-flavor> \
  --network <trusted-network> \
  --key-name <operator-key>

First boot does not depend on EC2 metadata. Optional static network material may be injected through cloud-init or config drive according to local OpenStack policy.

Air-gapped OCI Runtime Kit (Kubernetes)

For containerized deployments in disconnected Docker, containerd, or Kubernetes environments. The kit contains the engine, gate, and Redis-profile images, a Compose file for single-host GPU deployments, a Helm chart, and its own signed manifest.

Verify the kit:

sha256sum -c runtime-kit-MANIFEST.sha256
hx-sdp oci-kit validate --kit-root .

Load images:

zstd -dc containers/hx-engine.tar.zst | docker load
zstd -dc containers/hx-gate.tar.zst | docker load
zstd -dc containers/redis-profile.tar.zst | docker load

Kubernetes install:

kubectl create namespace hx-sdp
kubectl -n hx-sdp create secret generic hx-sdp-engine-service-key \
  --from-literal=value="$HX_GATE_ENGINE_SERVICE_KEY"
kubectl -n hx-sdp create secret generic hx-sdp-tenants \
  --from-file=tenants.json=tenants.json
helm upgrade --install hx-sdp ./helm/hx-sdp -n hx-sdp

Validate:

kubectl -n hx-sdp rollout status deploy/hx-sdp-engine
kubectl -n hx-sdp rollout status deploy/hx-sdp-gate
kubectl -n hx-sdp exec deploy/hx-sdp-engine -- hx-sdp gpu-preflight

The complete offline procedure, including ctr -n k8s.io images import and license and TLS secrets, ships in the kit as AIRGAP_LOAD.md. Kubernetes nodes require the NVIDIA Container Toolkit and a GPU device plugin.

After deployment