Update Air-Gapped Debian Systems Using apt-offline

This article explains the purpose of apt-offline and provides a straightforward guide on how it updates air-gapped Debian systems. An air-gapped computer is physically isolated from unsecured networks, including the internet, making standard software updates impossible through traditional package managers. You will learn the mechanics behind apt-offline and the step-by-step workflow required to generate update requests, download packages on an internet-connected machine, and apply them securely to your offline Debian instance.

What is apt-offline?

apt-offline is an offline Advanced Package Tool (APT) package management utility designed for Debian and Debian-based systems. In a standard setup, tools like apt-get directly query remote repositories to check for package definitions, dependencies, and software updates over an active network connection.

On an air-gapped system, network interfaces are disabled or physically absent. apt-offline bridges this gap by decoupling the package resolution and installation processes from the network download process. It allows the air-gapped host to calculate its own dependency requirements, delegate the downloading phase to a secondary, internet-connected computer, and subsequently install the fetched components locally.

How apt-offline Works

The process relies on transferring metadata and package archives between the air-gapped machine and an internet-connected machine using removable storage, such as a USB drive.

Step 1: Generate the Update Signature on the Air-Gapped Host

The air-gapped machine must determine what it needs. Using the current local package database, apt-offline generates a signature file containing information about available repositories, installed packages, and requested updates or installations.

To prepare a full system update signature:

sudo apt-offline set --update --upgrade apt-offline.sig

To request a specific package installation along with its dependencies:

sudo apt-offline set --install-package <package-name> apt-offline.sig

This creates the apt-offline.sig file. This signature file contains no binaries, only structured metadata specifying which files and Debian repositories need to be queried.

Step 2: Download the Data on a Connected Machine

The apt-offline.sig file is copied to removable media and moved to a machine with active internet access. The connected machine does not need to run Debian, but it must have Python and apt-offline installed (it also runs on Windows via Python).

On the connected machine, run:

apt-offline get --bundle update-bundle.zip apt-offline.sig

apt-offline reads the signature file, resolves URLs for the Debian mirrors, downloads the required package archives (.deb files), changelogs, bug reports, and APT database updates, and packages them into a single archive named update-bundle.zip.

Step 3: Apply the Updates to the Air-Gapped Host

The update-bundle.zip archive is moved back to the air-gapped Debian system via removable storage.

First, install the bundle contents into the local APT cache:

sudo apt-offline install update-bundle.zip

This command unpacks the repository lists and places downloaded .deb packages into Debian’s local package cache directory (/var/cache/apt/archives/).

Finally, complete the upgrade using native Debian tools:

sudo apt-get upgrade --no-download

APT verifies that all necessary dependencies are already present locally and completes the installation without attempting to initiate external network connections.