Why companies want it
A server cut off from the internet means a smaller attack surface and a simpler answer to the question of where the data is. Systems with personal, HR or production data often run this way. An app on such a server can still use the company network: the database, the user directory or the company mail server.
No internet doesn't mean no updates. A server cut off from the network still needs security patches; they just arrive another way: downloaded and checked on a trusted computer.
Dependencies without internet
- Download the packages on a computer with internet access
Ideally with the same Python version and the same system as the server. The pip download command saves all the dependencies to a folder.
- Check they are ready-made wheels
Wheel files (.whl) install without compiling. If the folder contains a source archive, installation will fail on a server without a compiler.
- Move the folder to the server
Together with the requirements.txt file, with the versions pinned.
- Install without network
pip install with the --no-index and --find-links options takes packages only from the local folder.
# on a computer with internet access (same Python version as the server) pip download -r requirements.txt -d packages --only-binary=:all: --platform win_amd64 --python-version 3.12 # on the server, without internet access pip install --no-index --find-links packages -r requirements.txt
Pure-Python libraries or ones shipped as ready-made wheels save the most trouble. Two examples from practice: for LDAP, the ldap3 library instead of python-ldap, which needs system libraries; and for turning PDF pages into images, PyMuPDF, which comes as a single wheel.
An application server on Windows
On Linux the standard for Python apps is gunicorn, but it doesn't run on Windows. There, Waitress, written in pure Python, does the job. In front of it sits a web server, on Windows usually IIS, as a reverse proxy: it handles HTTPS and the site address, and passes traffic on to the app.
Updates without internet
- A version with a number and a changelog
Every update is a package: code, dependencies and a description of what changed.
- A test on a copy
A test environment with a copy of the database. An update that passed there rarely surprises in production.
- A database backup right before the update
Regardless of the daily backups.
- Installation and database migrations
In a planned window, with a message for users.
- A rollback plan
The previous package and the database backup at hand. If something doesn't work, you're back in minutes and fix it calmly.
Diagnostics and order on site
Terms from this guide
- Reverse proxy
A server that receives traffic from the network and passes it on to an app running behind it. It usually also handles HTTPS and the site address.
- Wheel
A ready-to-install Python library package, a .whl file. It installs without compiling, also on a server without internet access.
Questions and answers
Can an app without internet send email?
Yes, through the company mail server on the internal network. Being cut off applies to the internet, not to the company network.
How do you install security patches?
The same way as dependencies: downloaded on a trusted computer, checked and moved over. For Windows, companies often use their own update server (WSUS).
Can AI run on such a server?
Yes. A local language model works without internet if the server has a suitable graphics card. Details are in the guide to hardware for a local model.
Sources and documentation
- pip download: fetching packages for offline installationpip.pypa.io
- pip install: installing from a local folderpip.pypa.io
- Waitress: a Python application server that runs on Windowsdocs.pylonsproject.org
- Django: deployment checklistdocs.djangoproject.com
- Microsoft: IIS as a reverse proxy (URL Rewrite and ARR)learn.microsoft.com