Linux Offline Package Installation for Air-Gapped Systems

Air-gapped systems—computers completely isolated from physical and wireless networks for security reasons—present unique challenges when installing and updating software. The Linux operating system facilitates offline package installation through a combination of modular package management architectures, dependency resolution utilities, local repository creation tools, and portable containerized formats. By downloading binary packages and their dependencies on a connected machine and transferring them via physical media, administrators can safely and reliably maintain air-gapped environments without compromising isolation.

Native Package Download Utilities

Standard Linux package managers include built-in mechanisms to download software packages and their entire dependency chains without executing an immediate installation. This process is typically performed on an internet-connected staging machine running the identical distribution and architecture as the target air-gapped system.

• Debian and Ubuntu (APT): Administrators can use commands such as apt-get download combined with dependency analysis, or utilities like apt-offline. The apt-offline tool generates a signature file on the disconnected machine, allowing the connected machine to download precisely what is missing before generating a bundle to import back into the air-gapped host.
• RHEL, CentOS, and Fedora (DNF/YUM): The dnf download --resolve --alldeps command (or yumdownloader on older systems) fetches specified RPM packages alongside all required runtime libraries directly into a designated local directory.

Creating Local and Private Repositories

Linux distributions are built to read repository metadata from local storage paths, such as directories mounted via USB or local drives, rather than strictly over HTTP or FTP.

• YUM/DNF Local Mirrors: Using the createrepo utility, administrators can scan a directory containing transferred RPMs and generate the XML metadata required by package managers. The target machine’s repository configuration file (/etc/yum.repos.d/) is then updated with a baseurl=file:///path/to/directory directive.
• APT Local Repositories: Tools like reprepro or dpkg-scanpackages generate the Packages.gz index files required by APT. The air-gapped system references this local directory in its /etc/apt/sources.list using the file:/ URI scheme.
• Optical Media Support: Most major distributions allow physical or virtual media (such as multi-GB DVD sets) to be registered directly as primary package sources using tools like apt-cdrom or local loop-mounted ISO images.

Portable Formats and Standalone Binaries

Linux supports portable, self-contained application packaging formats that eliminate the complex manual tracking of library dependencies across separate machines.

• AppImage: An AppImage is a single execution file that contains the application along with all the libraries it needs to run. Transferring an AppImage to an air-gapped machine requires no installation process—only execution permissions.
• Container Images: Using runtime tools like Podman or Docker, applications and their operating environments can be encapsulated into image files. Connected systems use commands like docker save or podman save to serialize images into .tar archives, which are subsequently unpacked on the isolated system using docker load or podman load.

Direct Binary and Source Installation

When high-level package management cannot be utilized, Linux natively supports low-level, direct installations:

• Direct Package Unpacking: Low-level package managers like dpkg -i *.deb or rpm -ivh *.rpm can install sets of pre-transferred packages locally, provided all dependencies are included in the same directory and passed simultaneously to the command.
• Compilation from Source: For custom or legacy environments, software source archives (.tar.gz or .tar.bz2) containing Makefiles can be transferred directly. Provided the target system has a pre-installed development toolchain (gcc, make, and development headers), applications can be compiled and installed locally using the traditional configure-make pipeline without any external network access.