Running an AI assistant with no internet at all
How air-gapped AI works in practice: weights baked into the image, egress denied at the firewall, and the test that proves it.
Some environments cannot have a network connection. Classified work, industrial control, medical devices, incident response on a compromised network, and anywhere a data-egress path is itself the risk.
Most “local AI” setups fail this test, because local inference is not the same as no network.
Why local isn’t automatically air-gapped
A stack that runs models locally may still, on first boot or on update: resolve a hostname, pull a container, fetch a model from a hub, check for updates, or report telemetry. Any one of those breaks the guarantee.
Air-gapped means nothing reaches out — not once, not on update, not by accident.
What has to be true
Everything needed at runtime is already on disk. Runtime, native modules, model weights, tokenizers, signature databases. Model weights are the part most stacks miss, because pulling from a hub is so normal it stops looking like a network dependency.
Egress is denied, not merely unused. A default-allow firewall with nothing configured to phone home is one bad dependency away from failing. Denial has to be enforced.
Updates work offline. Whole signed images moved on physical media, verified by signature before they are applied.
How deputyOS does it
Build with AIRGAP=1. That bakes LFM2 via llama.cpp into the
image, points apt at a local mirror, and locks egress at
nftables to RFC1918 and mDNS only.
Model by tier:
| Tier | Baked model |
|---|---|
| lean | LFM2-350M Q4_K_M |
| standard | LFM2-1.2B Q4_K_M |
| rich | LFM2-2.6B Q4_K_M + Qwen-Coder-1.5B |
deputyctl model set swaps between baked models with no network.
The test
Boot it with -net none, or pull the cable. If the assistant answers, it is
air-gapped. If anything hangs waiting on a resolver, it is not.
That test is the only claim worth making, and it is worth running yourself rather than believing a page like this one.
Reversibility
The posture is not one-way. deputyctl network unlock restores egress if the
device later moves to a connected environment — see
the airgap concept doc.
What you give up
Small local models are meaningfully less capable than frontier models. LFM2-2.6B is useful for summarising, extraction, classification and drafting; it will not match GPT-class reasoning. If your work needs frontier capability, an air-gapped deployment is the wrong tool and no amount of engineering fixes that.
air-gappedsecurityuse-case