Docs / Trust & compliance
Offline & air-gapped
Planned design. TractorStack is in development. This page describes how it is designed to work; nothing here is available to install yet. See the roadmap for the status of each part.
Planned
Some sites have no internet access at all. Others allow it only through a proxy, or only for a few approved hosts. TractorStack is designed so that none of its normal operations need to reach the internet: building hosts, installing services, deploying apps and applying updates all work from copies held on-site.
Even if your network is connected, local mirrors are worth having. Builds get faster, a public registry outage doesn’t stop a restart, and you know exactly which versions are in use.
What gets mirrored
| Content | Local copy | Used by |
|---|---|---|
| OS packages | A package repository mirror for your Linux distribution | Ansible when building and patching hosts |
| Container images | A local container registry | Docker Compose and Kubernetes |
| OpenTofu providers | A provider network mirror or filesystem mirror | OpenTofu |
| OpenTofu modules | Git repositories or archives on an internal server | OpenTofu |
| Helm charts | A chart repository, or charts stored as OCI artifacts in the local registry | Stages 3 and 4 |
| Ansible collections | Archives kept with the configuration repository | Ansible |
OS packages
The design keeps a dated snapshot of the distribution’s repositories. Hosts point at the snapshot, not at the public mirrors, so every host in an environment installs the same package versions.
Container images
Every image the platform and your apps use is copied into the local registry and referenced by a pinned tag or digest. This is already one of the Kubernetes-ready rules, so offline sites need no special app changes. Images are scanned before they are copied in.
OpenTofu providers and modules
OpenTofu can be told to install providers from a mirror instead of the public registry, and the tofu providers mirror command collects the providers a configuration needs into a folder. Modules are referenced from internal Git or archive sources. A planned example of the CLI settings:
# ~/.tofurc (illustrative, planned example)
provider_installation {
network_mirror {
url = "https://mirror.internal/providers/"
}
}Helm charts
Charts are pulled once, checked, and stored internally. Images referenced by a chart are mirrored too, and chart values point at the local registry.
Bringing updates in
Updates arrive through a controlled transfer process agreed with your security team. The planned flow:
- On a connected staging machine, collect the new package snapshot, images, providers and charts for an agreed list of versions.
- Scan them, record checksums, and produce a manifest of exactly what is included.
- Move the bundle across using your approved method, such as checked removable media or a one-way transfer.
- Verify the checksums on the inside, load the bundle into the local mirrors, and record the import.
- Roll out to a test group of hosts first, then to the rest, using the normal Git and Ansible process.
Each bundle is planned to be a commit in the configuration repository, so you can see which versions were brought in, when, and by whom.
Offline operation also affects time sync, DNS and certificates. The design uses internal NTP and DNS servers and an internal certificate authority. See Security.
If you run a restricted network and want to talk through how this would fit your transfer rules, contact sales@infratractor.com.
Last updated 25 October 2026 · Questions or corrections: sales@infratractor.com