Air-Gapped Installations#

For security purposes, some installations require that systems be isolated from the internet or outside networks.

An air-gapped system is not connected to an unsecured network, such as the public internet, to an unsecured LAN, or to other computers that are connected to an unsecured network. The default mechanisms to update software on DGX systems and loading container images from the NGC Container Registry require an Internet connection. On an air-gapped system, which is isolated from the Internet, you must provide alternative mechanisms to update software and load container images.

Since most DGX software updates are completed through an over-the-network process with NVIDIA servers, this section explains how updates can be made when using an over-the-network method is not an option. It also includes a process to load container images.

Here are the methods you can use:

Download the ISO image, copy it to removable media, and then reimage the DGX System from the media.

This method is available only for software versions that are available as ISO images for download. For details, see Reimaging the System. This section provides information about how to install the DGX OS.
Update the DGX software by performing a network update from a local repository.

This method is available only for software versions that are available for over-the-network updates.

Creating a Local Mirror of the NVIDIA and Canonical Repositories#

Here are the steps to download the necessary packages to create a mirror of the repositories that are needed to update NVIDIA DGX systems. For more information about DGX OS versions and the available release notes, refer to Release Notes

Note

These procedures apply only to maintenance updates within DGX OS 8. To upgrade between major DGX OS releases, follow the release-upgrade procedure.

Identify the sources that correspond to the public NVIDIA and Canonical repositories that provide updates to the DGX OS.

On DGX OS 8, identify the configured repository sources in these deb822 files:
- /etc/apt/sources.list.d/ubuntu.sources
- /etc/apt/sources.list.d/nvidia.sources
- /etc/apt/sources.list.d/dgx.sources
Create and maintain a private mirror of the repository sources that you identified in the previous step.
Update the sources that provide updates to the DGX system to use your private repository mirror instead of the public repositories.

To update these sources, modify the applicable deb822 files in /etc/apt/sources.list.d/ while retaining their Suites:, Components:, and Signed-By: fields.

Creating the Mirror of the Repositories#

The instructions in this section are to be performed on a system with internet access.

A system installed with Ubuntu OS is needed to create the mirror because there are several Ubuntu tools that need to be used.
You must be logged in to the system installed with Ubuntu OS as an administrator user because this procedure requires sudo privileges.
The system must contain enough storage space to replicate the repositories to a file system. The space requirement could be as high as 250 GB.
An efficient way to move a large amount of data is needed, for example, shared storage in a DMZ, or portable USB drives that can be brought into the air-gapped area.

The data will need to be moved to the systems that need to be updated. Format portable drives with ext4, or with an organization-approved file system that supports the required file sizes. Do not use FAT32: it cannot store individual files larger than 4 GB.

To create the mirror:

Ensure that the storage device is attached to the system with network access and identify the mount point of the device.

Here is a sample mount point that is used in these instructions:
```
/media/usb/repository
```

Install the apt-mirror package.

sudo apt update

sudo apt install apt-mirror

Change the ownership of the target directory to the apt-mirror user in the apt-mirror group.
```
sudo chown apt-mirror:apt-mirror /media/usb/repository
```
The target directory must be owned by the user apt-mirror, or the replication will not work.

Configure the path of the destination directory in /etc/apt/mirror.list. On a connected DGX OS system that runs the same release and architecture as the air-gapped targets, use the repository URIs and suites from ubuntu.sources, nvidia.sources, and dgx.sources. The following examples are for DGX OS 8.0.0 on Ubuntu 26.04 (resolute); do not use them unchanged for a different release.

For x86_64 systems:

############# config ##################
#
set base_path /media/usb/repository #/your/path/here
#
# set mirror_path $base_path/mirror
# set skel_path $base_path/skel
# set var_path $base_path/var
# set cleanscript $var_path/clean.sh
# set defaultarch <running host architecture>
# set postmirror_script $var_path/postmirror.sh
set run_postmirror 0
set nthreads 20
set _tilde 0
#
############# end config ##############
# Standard Canonical package repositories:
deb http://security.ubuntu.com/ubuntu resolute-security main multiverse universe restricted
deb http://archive.ubuntu.com/ubuntu/ resolute main multiverse universe restricted
deb http://archive.ubuntu.com/ubuntu/ resolute-updates main multiverse universe restricted
#
# CUDA-specific repositories:
deb http://developer.download.nvidia.com/compute/cuda/repos/ubuntu2604/x86_64/
# DOCA repository:
deb http://linux.mellanox.com/public/repo/doca/baseos9-latest/ubuntu26.04/x86_64/
#
# DGX-specific repositories:
deb http://repo.download.nvidia.com/baseos/9/ubuntu/resolute/x86_64/ resolute common dgx
deb http://repo.download.nvidia.com/baseos/9/ubuntu/resolute/x86_64/ resolute-updates common dgx
#
# Clean unused items
clean http://archive.ubuntu.com/ubuntu
clean http://security.ubuntu.com/ubuntu

Run apt-mirror and wait for it to finish downloading content.

This will take a long time, depending on the network connection speed.
```
sudo apt-mirror
```
Eject the removable storage with all packages.
```
sudo eject /media/usb/repository
```

Configuring the Target Air-Gapped System#

Here are the steps that explain how you can configure a target air-gapped DGX OS 8 system.

The instructions in this section are to be performed on the target air-gapped DGX system.

The target air-gapped DGX system is installed, has gone through the first boot process, and is ready to be updated with the latest packages.
The USB storage device on which the mirrors were created is attached to the target DGX system.

There are other ways to transfer the data that are not covered in this document as they will depend on the data center policies for the air-gapped environment.

Mount the storage device on the air-gapped system to /media/usb/repository for consistency.
Preserve the deb822 repository configuration and signing keys installed by nvidia-repositories and dgx-repositories. Do not create legacy .list files. On the target system, update these files to use the local mirror URI while retaining their existing Suites:, Components:, and Signed-By: fields:
- /etc/apt/sources.list.d/ubuntu.sources
- /etc/apt/sources.list.d/nvidia.sources
- /etc/apt/sources.list.d/dgx.sources
Retain the keyrings referenced by these files, including the Ubuntu archive keyring, cuda_debian_prod.gpg, dgx_debian_prod.gpg, GPG-KEY-Mellanox.gpg, and nvidia-doca-debian-gpg-public-key.gpg. Also retain /etc/apt/preferences.d/nvidia-dgx.

Replace the public URIs: entries in the deb822 files with the matching local mirror paths. For example, the x86_64 CUDA and DOCA entries in nvidia.sources use the following URIs:

URIs: file:///media/usb/repository/mirror/developer.download.nvidia.com/compute/cuda/repos/ubuntu2604/x86_64/

URIs: file:///media/usb/repository/mirror/linux.mellanox.com/public/repo/doca/baseos9-latest/ubuntu26.04/x86_64/

Disable or replace all public repository source entries so that APT uses only the local mirror. Disable any source stanzas, such as optional AI Workbench or HPC SDK repositories, that are not included in the local mirror.

Update the apt repository.

sudo apt update

The output from this command is similar to the following example.

Get:1 file:/media/usb/repository/mirror/security.ubuntu.com/ubuntu resolute-security InRelease [107 kB]
Get:2 file:/media/usb/repository/mirror/archive.ubuntu.com/ubuntu resolute InRelease [265 kB]
Get:3 file:/media/usb/repository/mirror/archive.ubuntu.com/ubuntu resolute-updates InRelease [111 kB]
Get:4 file:/media/usb/repository/mirror/developer.download.nvidia.com/compute/cuda/repos/ubuntu2604/x86_64  InRelease
Get:5 file:/media/usb/repository/mirror/repo.download.nvidia.com/baseos/9/ubuntu/resolute/x86_64 resolute InRelease [12.5 kB]
Get:6 file:/media/usb/repository/mirror/repo.download.nvidia.com/baseos/9/ubuntu/resolute/x86_64 resolute-updates InRelease [12.4 kB]
Get:7 file:/media/usb/repository/mirror/linux.mellanox.com/public/repo/doca/baseos9-latest/ubuntu26.04/x86_64  Release [697 B]
Get:8 file:/media/usb/repository/mirror/linux.mellanox.com/public/repo/doca/baseos9-latest/ubuntu26.04/x86_64  Release.gpg [836 B]
Reading package lists... Done

Upgrade the system using the newly configured local repositories.
```
sudo apt full-upgrade
```

Loading Container Images on an Air-Gapped System#

For instructions about loading container images onto an air-gapped DGX system, see Loading Container Images.