Air-gapped install

In regulated or isolated environments, the Warewulf server typically cannot reach depot.ciq.com directly. You can still install and update Warewulf Pro by mirroring the Depot repository to a host that has internet access, then pointing the air-gapped server at that local mirror.

Step 1 - Mirror the repository

On an internet-connected host that has Depot client installed:


# depot login
# depot enable warewulf-pro
# dnf -y install dnf-plugins-core epel-release
# reposync --repo=warewulf-pro --download-path=/srv/repos --download-metadata
# reposync --repo=epel --download-path=/srv/repos --download-metadata

This produces a complete offline copy of the warewulf-pro repository under /srv/repos/warewulf-pro/.

Warning

apptainer requires the fakeroot package, which on Rocky Linux 9 is only available from EPEL, not from BaseOS, AppStream, or CRB. The air-gapped server has no internet access at all, so fakeroot must be mirrored locally too (the reposync --repo=epel command above). Running dnf -y install epel-release alone is not enough without a reachable EPEL mirror.

Note

Mirror the warewulf-pro-rlc repository the same way if your entitlement includes RLC. See Pro node images: RLC variants.

Step 2 - Serve the mirror

Serve the mirror over HTTP from any web server reachable by the air-gapped Warewulf server. For a quick test:


# cd /srv/repos
# python3 -m http.server 8080

In production, use nginx, Apache, or another long-running HTTP server.

Step 3 - Point dnf at the local mirror

On the air-gapped Warewulf server, create a new repo file:


# /etc/yum.repos.d/warewulf-pro-local.repo
[warewulf-pro-local]
name=Warewulf Pro (local mirror)
baseurl=http://mirror.local:8080/warewulf-pro/
enabled=1
gpgcheck=1
gpgkey=http://mirror.local:8080/rpm-gpg-key-ciq

[epel-local]
name=EPEL (local mirror)
baseurl=http://mirror.local:8080/epel/
enabled=1
gpgcheck=1
gpgkey=http://mirror.local:8080/rpm-gpg-key-epel

Warning

Keep gpgcheck=1 on both repos. For warewulf-pro-local, mirror CIQ's signing key (https://ciq.com/keys/rpm-gpg-key-ciq) to the connected host and serve it from your local HTTP root. For epel-local, copy /etc/pki/rpm-gpg/RPM-GPG-KEY-EPEL-9 from the connected host (installed there by epel-release) to the same HTTP root. Disabling signature verification (gpgcheck=0) is not recommended.

Then install as normal:


# dnf -y install warewulf warewulf-cockpit apptainer cockpit "warewulf-overlays-*"
# systemctl enable --now warewulfd cockpit.socket

Mirroring node images

The Pro node images live in a separate OCI registry namespace (docker://depot.ciq.com/warewulf-pro/warewulf-node-images/). Use skopeo on the connected host to mirror them:


# skopeo copy --all \
    docker://depot.ciq.com/warewulf-pro/warewulf-node-images/rockylinux-slurm:24 \
    docker://registry.local:5000/warewulf-node-images/rockylinux-slurm:24

Then import on the Warewulf server using the local registry URL:


# wwctl image import docker://registry.local:5000/warewulf-node-images/rockylinux-slurm:24 slurm-24

Updating

When new Pro releases ship, re-run reposync on the connected host. The air-gapped server will pick up the updates on its next dnf update.

Standard install via Depot Overview