Skip to main content

Running R in Offline Secure tiCrypt VMs

· 3 min read
Thomas Samant
Thomas Samant

R is a staple of statistical computing and graphics across research, healthcare, finance, and government. But in a tiCrypt environment, secure VMs operate offline by design. There's no direct internet access, which means no connection to CRAN or other package repositories.

That doesn't mean you're stuck without libraries. tiCrypt supports two approaches to R package management in offline VMs: local installation from transferred files, and installation from a CRAN mirror on an NFS mount.

Option 1: Install Packages Locally​

This approach works in any tiCrypt deployment. You download packages on an internet-connected machine, transfer them into the VM, and install from local files.

Step 1: Download the packages. On a machine with internet access, download the R package files (typically .tar.gz) from CRAN or another repository. Be sure to grab any dependencies as well.

Step 2: Transfer to the VM. Move the downloaded files into your tiCrypt VM using one of the approved secure transfer methods (e.g., Vault upload, SFTP, or drive attachment).

Step 3: Install from local files. In your R console, run:

install.packages("path_to_file", repos = NULL, type = "source")

Replace path_to_file with the actual path to the downloaded package file.

Option 2: Install from an NFS-Mounted CRAN Mirror​

If your deployment includes a CRAN repository mirrored on an NFS share accessible to the VM, you can skip the file transfer step entirely.

Step 1: Set the library path. Point R to the NFS mount where the CRAN mirror resides:

.libPaths("file:///path_to_cran_mirror")

Replace path_to_cran_mirror with the actual mount path.

Step 2: Install packages. Install directly from the mirror:

install.packages("PACKAGE_NAME", repos = NULL, type = "source")

Replace PACKAGE_NAME with the name of the package you want to install.

Deployments with a Pre-Configured CRAN Mirror​

Some tiCrypt deployments come with RStudio available directly from the applications toolbar and a CRAN mirror already mounted via NFS. In these environments, the setup is even simpler. The R startup message may also include package installation instructions as a quick reference.

Launch RStudio from the applications toolbar.

Set the library path to the pre-configured CRAN mirror. Your administrator can provide the exact mount path, but a typical example looks like:

.libPaths("file:///mnt/modules/cran/src/contrib")

Install packages using either of the following approaches:

If the global library path has already been set:

install.packages("PACKAGE_NAME", repos = NULL, type = "source")

Or specify the contriburl directly:

install.packages("PACKAGE_NAME", contriburl = "file:///mnt/modules/cran2/src/contrib", type = "source")

Offline Doesn't Mean Limited​

tiCrypt's offline VM model exists to prevent data exfiltration and maintain a strong security boundary. Package management works within that model. Whether you're transferring files manually or pulling from a local CRAN mirror, the full R ecosystem remains available to researchers working inside the enclave.