make poetry install work offline in a hermetic/network-isolated build environment

[harshitbansal184507]

Hi,

I've been trying to make poetry install work offline in a hermetic/network-isolated build environment and hit a wall. Tried three things:

1)Pre-populated Poetry's artifact cache with correct paths, but Poetry still makes a network call before checking the cache for PyPI packages.
2)Rewrote poetry.lock with file:// URLs, failed because requests doesn't support file:// scheme.
3)Injected real HTTPS URLs into poetry.lock and pre-populated cache, tested live with network blocked, _download_link in executor.py still went straight to network and ignored the cache completely.

Am I missing something or there is no support around offline installs ?

[radoering]

As far as I know, we have never tried to support offline installs.

I assume we would prefer to avoid unnecessary network requests if someone were to take the time to check whether they are necessary or could be avoided with a pre-populated cache, since they are likely to slow down the installation.

[shahabRDZ]

been there. building behind a corporate proxy with no internet access is painful.

here is the approach that works reliably for hermetic builds:

step 1: download everything on a machine WITH internet

# export all wheels to a local directory
poetry export -f requirements.txt --output requirements.txt
pip download -r requirements.txt -d ./vendor/

step 2: configure poetry to use the local directory as a source

# pyproject.toml
[[tool.poetry.source]]
name = "local"
url = "file:///path/to/vendor"
priority = "primary"

step 3: install offline

poetry config virtualenvs.create true
poetry install --no-interaction

alternative approach — pip install from vendor dir directly:

if you do not strictly need poetry for the install step:

poetry export -f requirements.txt -o requirements.txt
pip install --no-index --find-links=./vendor/ -r requirements.txt

this is what we use in our CI pipeline. poetry handles the dependency resolution and lockfile on dev machines, but the actual install in the air-gapped environment uses pip + vendored wheels. simpler and more reliable.

one gotcha: make sure you download wheels for the correct platform. if you build on mac but deploy on linux, use pip download --platform manylinux2014_x86_64 --only-binary=:all:.

[harshitbansal184507]

Thanks a lot for the detailed writeup, the alternative approach doesn't work for what I am working with currently. I strictly need to use poetry for install step.

do you personally use the first approach, where Poetry is configured with the file:// local source and poetry install is run directly in the offline environment? I believe I tried something similar before and it didn't work for me. Just curious whether it's actually been running smoothly in your setup or if you've hit any issues with it.

[MukundaKatta]

Stop trying to make poetry install itself run offline, use pip against a pre-fetched wheelhouse. Online phase: poetry export -f requirements.txt --without-hashes then pip download -r requirements.txt -d wheelhouse. Offline phase: pip install --no-index --find-links=./wheelhouse -r requirements.txt. Poetry's value here is the resolver (it gave you the locked graph), the installer is effectively pip. All three failures you hit trace back to Poetry's downloader assuming it can always hit an index to validate metadata, even with a cached hit.