Air-Gapped Installations#

Ubuntu#

For security purposes, some installations require that systems be isolated from the internet or outside networks.

An air-gapped system is not connected to an unsecured network, such as the public internet, to an unsecured LAN, or to other computers that are connected to an unsecured network. The default mechanisms to update software on DGX systems and to load container images from the NGC Container Registry require an internet connection. On an air-gapped system, which is isolated from the internet, you must provide alternative mechanisms to update software and load container images.

Because most BaseOS software updates are completed through an over-the-network process with NVIDIA servers, this section explains how updates can be made when using an over-the-network method is not an option.

Use one of the following methods:

Download the ISO image, copy it to removable media, and then reimage the DGX system from the media.

This method is available only for software versions that are available as ISO images for download. For details, refer to Reimaging the System. That section provides information about how to install the BaseOS.
Update the BaseOS software by performing a network update from a local repository.

This method is available only for software versions that are available for over-the-network updates.

Creating a Local Mirror of the NVIDIA and Canonical Repositories#

Here are the steps to download the necessary packages to create a mirror of the repositories that are needed to update NVIDIA DGX systems. For more information about BaseOS versions and the release notes available, refer to BaseOS 9 Release Notes

Note

These procedures apply only to upgrades in the same major release, such as from 9.x to 9.y. The steps do not support upgrades across major releases, such as from BaseOS 8 to BaseOS 9.

Identify the sources that correspond to the public NVIDIA and Canonical repositories that provide updates to the BaseOS.

You can identify these sources from the /etc/apt/sources.list file and the contents of the /etc/apt/sources.list.d/ directory, or by using System Settings > Software & Updates.
Create and maintain a private mirror of the repository sources that you identified in the previous step.
Update the sources that provide updates to the DGX system to use your private repository mirror instead of the public repositories.

To update these sources, modify the /etc/apt/sources.list file and the contents of the /etc/apt/sources.list.d/ directory.

Creating the Mirror of the Repositories#

The instructions in this section are to be performed on a system with internet access.

A system with Ubuntu installed is needed to create the mirror because several Ubuntu tools must be used.
You must be logged in to the system installed with Ubuntu OS as an administrator user because this procedure requires sudo privileges.
The system must contain enough storage space to replicate the repositories to a file system. The space requirement could be as high as 250 GB.
An efficient way to move a large amount of data is needed, for example, shared storage in a DMZ, or portable USB drives that can be brought into the air-gapped area.

Move the data to the systems that need to be updated. Make sure that any portable drives are formatted using ext4 or FAT32.

To create the mirror:

Ensure that the storage device is attached to the system with network access and identify the mount point of the device.

Here is a sample mount point that was used in these instructions:
```
/media/usb/repository
```

Install the apt-mirror package.

sudo apt update

sudo apt install apt-mirror

Change the ownership of the target directory to the apt-mirror user in the apt-mirror group.
```
sudo chown apt-mirror:apt-mirror /media/usb/repository
```
The target directory must be owned by the user apt-mirror, or the replication does not work.

Configure the path of the destination directory in /etc/apt/mirror.list and use the included list of repositories below to retrieve the packages for both Ubuntu OS and the NVIDIA BaseOS OS packages.

For x86_64 systems:

############# config ##################
#
set base_path /media/usb/repository #/your/path/here
#
# set mirror_path $base_path/mirror
# set skel_path $base_path/skel
# set var_path $base_path/var
# set cleanscript $var_path/clean.sh
# set defaultarch <running host architecture>
# set postmirror_script $var_path/postmirror.sh
set run_postmirror 0
set nthreads 20
set _tilde 0
#
############# end config ##############
# Standard Canonical package repositories:
deb http://security.ubuntu.com/ubuntu resolute-security main multiverse universe restricted
deb http://archive.ubuntu.com/ubuntu/ resolute main multiverse universe restricted
deb http://archive.ubuntu.com/ubuntu/ resolute-updates main multiverse universe restricted
#
deb-i386 http://security.ubuntu.com/ubuntu resolute-security main multiverse universe restricted
deb-i386 http://archive.ubuntu.com/ubuntu/ resolute main multiverse universe restricted
deb-i386 http://archive.ubuntu.com/ubuntu/ resolute-updates main multiverse universe restricted
#
# CUDA specific repositories:
deb http://developer.download.nvidia.com/compute/cuda/repos/ubuntu2604/x86_64/ /
#
# BaseOS specific repositories:
deb http://repo.download.nvidia.com/baseos/ubuntu/resolute/x86_64/ resolute common dgx
deb http://repo.download.nvidia.com/baseos/ubuntu/resolute/x86_64/ resolute-updates common dgx
#
deb-i386 http://repo.download.nvidia.com/baseos/ubuntu/resolute/x86_64/ resolute common dgx
deb-i386 http://repo.download.nvidia.com/baseos/ubuntu/resolute/x86_64/ resolute-updates common dgx
# Clean unused items
clean http://archive.ubuntu.com/ubuntu
clean http://security.ubuntu.com/ubuntu

For ARM64 systems:

############# config ##################
#
set base_path /media/usb/repository #/your/path/here
#
# set mirror_path $base_path/mirror
# set skel_path $base_path/skel
# set var_path $base_path/var
# set cleanscript $var_path/clean.sh
# set defaultarch <running host architecture>
# set postmirror_script $var_path/postmirror.sh
set run_postmirror 0
set nthreads 20
set _tilde 0
#
############# end config ##############
# Standard Canonical package repositories:
deb http://ports.ubuntu.com/ubuntu-ports/ resolute-security main multiverse universe restricted
deb http://ports.ubuntu.com/ubuntu-ports/ resolute main multiverse universe restricted
deb http://ports.ubuntu.com/ubuntu-ports/ resolute-updates main multiverse universe restricted
#
# CUDA specific repositories:
deb  http://developer.download.nvidia.com/compute/cuda/repos/ubuntu2604/sbsa/ /
#
# BaseOS specific repositories:
deb http://repo.download.nvidia.com/baseos/ubuntu/resolute/arm64/ resolute common dgx
deb http://repo.download.nvidia.com/baseos/ubuntu/resolute/arm64/ resolute-updates common dgx
#
# Clean unused items
clean http://ports.ubuntu.com/ubuntu-ports/

Run apt-mirror and wait for it to finish downloading content.

This takes a long time, depending on the network connection speed.
```
sudo apt-mirror
```
Eject the removable storage with all packages.
```
sudo eject /media/usb/repository
```

Configuring the Target Air-Gapped System#

The following steps explain how to configure a target air-gapped DGX system.

The instructions in this section are to be performed on the target air-gapped DGX system.

The target air-gapped DGX system is installed, has gone through the first boot process, and is ready to be updated with the latest packages.
The USB storage device on which the mirrors were created is attached to the target DGX system.

There are other ways to transfer the data that are not covered in this document because they depend on the data center policies for the air-gapped environment.

Mount the storage device on the air-gapped system to /media/usb/repository for consistency.

Configure the apt command to use the file system as the repository in the file /etc/apt/sources.list by modifying the following lines.

For x86_64 systems:

deb file:///media/usb/repository/mirror/security.ubuntu.com/ubuntu resolute-security main multiverse universe restricted
deb file:///media/usb/repository/mirror/archive.ubuntu.com/ubuntu/ resolute main multiverse universe restricted
deb file:///media/usb/repository/mirror/archive.ubuntu.com/ubuntu/ resolute-updates main multiverse universe restricted

For ARM64 systems:

deb file:///media/usb/repository/mirror/ports.ubuntu.com/ubuntu-ports/ resolute-security main multiverse universe restricted
deb file:///media/usb/repository/mirror/ports.ubuntu.com/ubuntu-ports/ resolute main multiverse universe restricted
deb file:///media/usb/repository/mirror/ports.ubuntu.com/ubuntu-ports/ resolute-updates main multiverse universe restricted

Configure apt to use the NVIDIA BaseOS packages in the /etc/apt/sources.list.d/dgx.list file.

For x86_64 systems:

deb file:///media/usb/repository/mirror/repo.download.nvidia.com/baseos/ubuntu/resolute/x86_64/ resolute common dgx
deb file:///media/usb/repository/mirror/repo.download.nvidia.com/baseos/ubuntu/resolute/x86_64/ resolute-updates common dgx

For ARM64 systems:

deb file:///media/usb/repository/mirror/repo.download.nvidia.com/baseos/ubuntu/resolute/arm64/ resolute common dgx
deb file:///media/usb/repository/mirror/repo.download.nvidia.com/baseos/ubuntu/resolute/arm64/ resolute-updates common dgx

Configure apt to use the NVIDIA CUDA packages in the /etc/apt/sources.list.d/cuda-compute-repo.list file.

For x86_64 systems:

deb file:///media/usb/repository/mirror/developer.download.nvidia.com/compute/cuda/repos/ubuntu2604/x86_64/ /

For ARM64 systems:

deb file:///media/usb/repository/mirror/developer.download.nvidia.com/compute/cuda/repos/ubuntu2604/sbsa/ /

Update the apt repository.

sudo apt update

The output from this command is similar to the following example.

Get:1 file:/media/usb/repository/mirror/security.ubuntu.com/ubuntu resolute-security InRelease [107 kB]
Get:2 file:/media/usb/repository/mirror/archive.ubuntu.com/ubuntu resolute InRelease [265 kB]
Get:3 file:/media/usb/repository/mirror/archive.ubuntu.com/ubuntu resolute-updates InRelease [111 kB]
Get:4 file:/media/usb/repository/mirror/developer.download.nvidia.com/compute/cuda/repos/ubuntu2604/x86_64  InRelease
Get:5 file:/media/usb/repository/mirror/repo.download.nvidia.com/baseos/ubuntu/resolute/x86_64 resolute InRelease [12.5 kB]
Get:6 file:/media/usb/repository/mirror/repo.download.nvidia.com/baseos/ubuntu/resolute/x86_64 resolute-updates InRelease [12.4 kB]
Get:7 file:/media/usb/repository/mirror/developer.download.nvidia.com/compute/cuda/repos/ubuntu2604/x86_64  Release [697 B]
Get:8 file:/media/usb/repository/mirror/developer.download.nvidia.com/compute/cuda/repos/ubuntu2604/x86_64  Release.gpg [836 B]
Reading package lists... Done

Upgrade the system using the newly configured local repositories.
```
sudo apt full-upgrade
```

Red Hat Enterprise Linux#

Refer to Installing on “Air-Gapped” Systems.