SECURITY
Orion runs inside
your network
and stays there.
You install Orion on your own machines, and it can run with no internet connection. People sign in through your identity provider, and every workload runs as the person who launched it.
CUSTOMER-HOSTED
You run Orion. We never host it.
Orion installs into your cluster. Your data never leaves it.
BUILT TO RUN AIR-GAPPED
Nothing phones home.
Orion was built to run air-gapped, and it runs the same way on a connected cluster. The signed, node-locked license is checked locally, and no logs are exported to us.
Install from inside the gap
Mirror the images into your own registry and the Helm charts into your Git host, then run the installer on an offline host.
One version for every site
There is no separate air-gapped version. Connected and disconnected clusters run the same Orion.
IDENTITY AND ACCESS
Your identity provider decides who gets in.
Orion signs people in through LDAP or single sign-on and maps their groups to roles. Roles decide who can launch, share, or administer.
Single sign-on
Connect LDAP or Active Directory, including LDAPS with your own certificate authority, or sign in with Google or AWS Cognito. Users and groups sync to Orion roles.
Workloads run as the user
Every workload runs as the user’s own UID and GID, so identity reaches the file.
Session limits
Admins choose how many idle hours sign a user out and how long any session can last after sign-in.
Checked on the server
Orion checks roles on the backend, including calls between its own services.
ISOLATION AND QUOTAS
Each team gets its own workspace.
Workspaces keep teams apart, and quotas keep one team from starving the rest.
ADMIN OVERSIGHT
Admins set the rules and can step in.
Admins decide who can launch what. People only see the workspaces and templates assigned to their groups.
Take control to help
An admin can take control of a user’s workload to debug a problem or train someone.
Events and logs per workload
Open any workload to see its resources, events, and container logs.
Sharing is a workspace setting
Admins choose, per workspace, whether people can share workloads with each other.
COMPLIANCE
Built for your environment.
Orion runs inside your boundary, so your team assesses it like any other software you install. We send our security documentation on request.
