List the packages your air-gapped Linux machines need. Packtrix resolves every dependency for every distro you run, then builds signed APT and RPM repositories you can carry across the air gap.
Name the distros your machines run and the packages they need. Packtrix knows each distro's official repositories and signing keys, and adds vendor repositories such as Docker's or Kubernetes' when a package needs them.
packtrix plan # resolve, write packtrix.lock
packtrix sync # download, verify, sign
packtrix export # one bundle for the air gap
apiVersion: packtrix.io/v1alpha1
kind: OfflineRepository
metadata:
name: k8s-nodes
spec:
targets:
- distro: ubuntu-24.04
- distro: ubuntu-22.04
- distro: rocky-9
packages:
- curl
- conntrack
- docker-ce # adds Docker's repository
- name: kubelet
version: "1.34.*" # picks Kubernetes 1.34
- name: apache
deb: apache2 # names differ by format
rpm: httpdPacktrix runs in two places: a connected machine that has internet access, and the offline side that serves your machines.
Connected side
Packtrix resolves the dependencies of every listed package for each distro, from the repositories' own metadata. The lockfile records every package, version, checksum and source.
Connected side
It downloads exactly what the lockfile lists, verifies each file against the vendor's signatures, builds one signed repository per distro, and packs everything into a bundle.
Offline side
The offline side verifies the bundle and publishes it as a new snapshot. Machines install with plain apt and dnf, from any web server.
The package list is written once. Differences between formats are per-package exceptions, not separate files.
Packtrix follows the rules apt and dnf apply, from the repositories' metadata. It's a single binary: no container runtime, no apt or dnf needed.
Docker, Kubernetes, NVIDIA, EPEL and others are added when a listed package needs them, and the plan always shows it.
The lockfile records exactly what crosses the air gap. An update is a diff to review, and it ships as a small delta bundle.
Every package traces back to an upstream signature made by a pinned key. Your repositories are signed with your own key.
Standard APT and RPM repositories, served by any web server. Machines need no agent, plugin or special client.
Node prerequisites, the container runtime and kubelet, for Ubuntu and RHEL-family nodes, from one manifest.
An approved package set, where every change is reviewed before it enters.
Scheduled, security-only updates, shipped as small delta bundles.
Small repositories and small updates over slow or intermittent links.
Moving from Ubuntu 22.04 to 24.04, or from CentOS to Rocky, means adding a target. The package list stays the same.
Image builds install from a pinned snapshot instead of whatever upstream serves that day.
Packtrix builds signed APT repositories for Ubuntu and Debian today: get started. Each release adds a working part of the pipeline; the roadmap has the details.
v0.1.0
Resolve and mirror Ubuntu 22.04/24.04 and Debian 12/13 into signed APT repositories.
v0.2.0
Rocky Linux 9 and AlmaLinux 9, on the same resolver and pipeline.
v0.3.0
Snapshots, bundles, delta updates, update checks and plan diffs.
v0.4.0
Vendor repositories found automatically, more distros, RHEL and arm64 for RPM.
The design is open for feedback. Tell us about the distros, packages and air-gap constraints you deal with: they shape the manifest and its defaults.