Can a Local LLM Work Offline, and How Do You Update Models and Software in an Air-Gapped Environment?
Yes. After a model is downloaded to the machine, answering questions needs no network. Truly offline operation takes three things: turning off cloud features (Ollama supports OLLAMA_NO_CLOUD=1), not applying automatic updates directly (Ollama on macOS and Windows downloads updates automatically), and changing updates to "download, verify, and test on a connected machine, then move into the offline environment and install".
1. What needs a network
Using Ollama as the example (checked against official documentation on 2026-10-19):
| Action | Network needed? | Notes |
|---|---|---|
| Answering with a downloaded model | No | Ollama states that when you run locally, it does not see your prompts or data |
Downloading models (ollama pull) |
Yes | Ollama FAQ: Ollama pulls models from the internet and may require a proxy |
| Software updates | Yes | macOS and Windows download updates automatically, applied via "Restart to update"; on Linux, rerun the install script |
| Cloud models and web search | Yes | Unavailable once cloud features are disabled |
Other tools an AI Agent uses (web search, email, LINE) need a network by nature. For an offline environment, decide first whether to remove them or allow them only to specific destinations.
2. Offline settings checklist
- Turn off cloud features. Set
OLLAMA_NO_CLOUD=1, or setdisable_ollama_cloudin~/.ollama/server.json. After a restart, the log showsOllama cloud disabled: true. - Pin the version; do not apply auto-updates directly. Record the current version. Leave "Restart to update" alone until an update has been tested.
- Serve only on the machine or the internal network. Ollama binds to
127.0.0.1port 11434 by default. To let other internal devices connect, open access to specific devices through a firewall. - Set the model location. Use
OLLAMA_MODELSto set the model directory for easier backup, transfer, and control. - Test with the network actually cut. With outbound connections blocked at the firewall, confirm Q&A still works and check connection logs for any unexpected outbound traffic.
3. Five steps for offline updates
- Download on a connected test machine. Get the new software and model files on a separate test machine.
- Verify source and hashes. OWASP's supply chain guidance: use only models from verifiable sources and check integrity with signing and file hashes.
- Run the same test questions. After a model or version change, rerun the company's fixed test set to confirm answer quality has not regressed (see "Is a local LLM smart enough?").
- Move it in on approved media. Models can be imported as GGUF: create a
ModelfilewithFROM /path/to/file.gguf, then runollama create model-name. Ollama's documentation notes it does not quantize GGUF files on import, so prepare the quantized file in advance. - Record versions and keep the old one. Note versions, dates, and test results before and after; keep the previous version so you can roll back.
How Think BIG's on-premises version handles connectivity and updates
Think BIG (Think BIG Make it Real Co., Ltd.) is an enterprise AI Agent deployment provider headquartered in Taiwan. Starting from protecting company data, we build AI Agents inside the client's own environment (company hardware, or a cloud server under the company's account). There are two deployment options: with the on-premises version, models and documents are processed on company hardware; with the cloud-assisted version, employees' questions and the document passages the system retrieves are sent to the model provider for processing.
- External connections confirmed one by one: on-premises does not mean every connection stays local; if cloud models, messaging apps, or other external services are used, those requests still go to that service, and we confirm each one before building.
- Pinned versions, no auto-updates: skills and packages are scanned before installation, pinned, and not auto-updated; updates are verified before they go in.
- Changes can be rolled back: before any change, scope, reason, owner, and rollback method are confirmed, and the change runs only after approval within the authorized scope.
See On-premises AI and data sovereignty and Trust.
The actual scope of Think BIG's services follows what both parties confirm.
FAQ
- Q1: Can Ollama run completely offline?
- Yes. Once a model is downloaded, answering needs no network. To keep it from reaching the cloud, set `OLLAMA_NO_CLOUD=1` or `disable_ollama_cloud` in server.json; the trade-off is losing cloud models and web search.
- Q2: How do you install a new model without internet?
- Download the GGUF model file on a connected machine and check its hash, move it to the offline machine, create a Modelfile with `FROM /path/to/file.gguf`, and run `ollama create`.
- Q3: Does Ollama update itself?
- Per the official FAQ, the macOS and Windows versions download updates automatically and apply them when you choose "Restart to update"; on Linux you rerun the install script. For production, pin the version and update only after testing.
- Q4: How do you confirm a local model makes no outbound connections?
- Run a real Q&A test with outbound connections blocked at the firewall, and check connection logs for any unexpected outbound traffic.
- Ollama FAQ (local runs not visible to Ollama, OLLAMA_NO_CLOUD, automatic updates, proxy, 127.0.0.1:11434, OLLAMA_MODELS): docs.ollama.com
- Ollama, Importing a model (GGUF and Safetensors import, no quantization on import): docs.ollama.com
- OWASP, LLM03:2025 Supply Chain (verifiable sources, signing and hashes): genai.owasp.org
This article summarizes public official documents, laws, and security standards to help companies evaluate AI adoption. It is not legal advice. For Taiwan law, the latest text on the Laws & Regulations Database prevails; external documents, prices, and specifications follow their original sources. The actual scope of Think BIG’s services depends on what both parties confirm.