Why an air-gapped network needs an Office alternative that works without the cloud
On an isolated network, LibreOffice installed from an internal package repository covers desktop editing, and Collabora Online or ONLYOFFICE running on a server inside the enclosure covers browser editing. Teams chose Office LTSC because it needs no cloud service, so any replacement must keep documents, activation and updates inside the boundary. Two triggers usually force the decision: the support timeline of the Office LTSC version on your desktops, and a security posture that now blocks outbound connections, including activation checks. Start by checking your Office LTSC version against Microsoft's lifecycle information, because that date sets your planning window. Then sort users into three groups: desktop editors, browser editors and the few who still need Office for specific workflows. Download links for the desktop suite are on the LibreOffice download page.
Every option still needs a verified offline update path, and that is where most air-gapped projects stall. For LibreOffice, mirror the release packages and your deployment tooling into an internal repository, then verify checksums or signatures on each package before it crosses the boundary. For Collabora Online, the free CODE edition is a rolling release that Collabora does not recommend for production, so ask whether the paid enterprise edition, which adds long-term support and signed security updates, fits your patch cycle. For ONLYOFFICE, confirm which edition and license terms allow internal mirroring and offline operation. If your environment falls under NERC CIP-013-2, its supply chain requirements expect verification of software integrity and authenticity for patches, which applies directly to this step. Record who approves each import, how often you pull updates and how a fix reaches the desktop fleet and the browser server.
Plan the document exchange before you plan the software. Office LTSC files often carry macros, templates, embedded objects and tracked changes, and LibreOffice's documentation warns that some Microsoft Office features may not convert cleanly, including revision marks, pivot tables and conditional formatting. Test a sample of your most complex files in both directions before cutover, and budget reviewer time for the ones that need manual repair. Decide how documents leave the network for outside parties, because that exchange is the point where data crosses the boundary. Agree on one format that recipients can open, log which files are sent and keep Office licenses for the workflows that depend on VBA or exact layout until the replacements pass testing. The LibreOffice help on converting Office documents lists the features to check first.
What an air-gapped office suite must satisfy
An office suite on an isolated network is judged less by its features than by how it behaves at the boundary. The cards below set out six requirements that connect activation, updates, document handling and server-side editing, and they show where a sponsor should ask an assessor which frameworks apply.
No outbound calls at runtime
The suite must start, edit, save and print without contacting activation servers, licensing services or telemetry endpoints. Test this on a network segment with DNS and egress blocked, then watch for failed connections in the firewall logs. Confirm each product's offline licensing mode in writing before purchase, because some editions depend on a cloud check for activation or feature entitlement.
Packages verified across the boundary
Every installer, update and plugin crossing into the enclave needs a recorded hash or signature check, a named approver and a copy kept in an internal repository. NERC CIP-013-2 asks that procurement processes address verifying the integrity and authenticity of vendor software and patches, so the transfer procedure is evidence as much as a technical step. Keep the vendor's signing keys and checksum sources on the approval record.
Remote access to editing servers
Where the environment falls under NERC CIP-005-7, interactive remote access to in-scope systems must pass through an Intermediate System with encryption and multi-factor authentication, and vendor sessions must be detectable and disableable. Office servers rarely qualify as BES Cyber Systems, so confirm scope with the assessor before designing access. Vendor support tunnels to the editing server should follow the same rules when they are in scope.
Documents that stay inside the enclave
Document content, metadata, autosave files, crash recovery copies and print spool data should all be stored on enclave hardware. Check where the browser-based editor caches files, whether the server writes temporary files outside the data volume, and how logs record document names. Decide early whether document previews or thumbnails are generated on the server or on the client.
Editing on internal servers
Browser editing needs a document server that the internal file platform can reach, with no third-party fonts, images or scripts loaded from the internet. Collabora Online works with WOPI hosts such as Nextcloud, and its Helm chart requires load balancers to route by the WOPISrc parameter so co-editors reach the same pod. Test that co-authoring still works with the internet blocked.
Exchange with outside parties
Documents leaving the enclave should pass through a controlled gateway that applies content inspection, format conversion to a shared standard such as PDF or ODF, and a logged approval step. Ask the assessor whether the gateway itself is in scope for the control set that applies to your environment. Other frameworks, including CMMC under 32 CFR Part 170 and FedRAMP, must be confirmed with the assessor before anyone relies on them.
Which open-source option fits which offline setup
This table compares LibreOffice on desktops, Collabora Online on an internal server and ONLYOFFICE on an internal server for networks with no internet access. Read each row as a question to settle during a pilot, and treat unconfirmed vendor terms as open items. The main takeaway is that Microsoft format limits and macro handling matter as much as the deployment model, so test with your own documents.
| Requirement | LibreOffice on desktops | Collabora Online on internal server | ONLYOFFICE on internal server |
|---|---|---|---|
| How it runs offline | Installs from an internal package repository or media onto each workstation with no outside calls needed | Runs on an internal server from Docker images, system packages or Kubernetes, with browsers connecting inside the network | Deployed on an internal server; confirm the offline install and update procedure with the vendor |
| Microsoft format fidelity | Docx, xlsx and pptx open and save, but complex files need manual reformatting in proportion to their complexity | Edits docx, xlsx and pptx on LibreOffice technology, so expect the same conversion limits and test with your files | Confirm supported formats and fidelity with the vendor, then test with representative Office files |
| Known conversion gaps | AutoShapes, revision marks, OLE objects, pivot tables, conditional formatting and some formulas may not convert cleanly | Same gaps apply because the editing engine is shared with LibreOffice, so pilot the affected document types | Confirm which Office features convert cleanly before committing a document workflow |
| Licensing | Source code under MPL-2.0; the Document Foundation does not provide technical support | Server code under MPL-2.0; CODE is free but not recommended for production; Business plan at 3 euros per user per month for up to 99 users per Collabora pricing | Confirm license terms and whether air-gapped use is covered before procurement |
| Macros | Uses Basic macros, not VBA; Office VBA stays in the file and runs again in Office, and some Excel VBA can run if enabled | Confirm which macro types the browser editing path supports before relying on any VBA logic | Confirm macro support and any limits with the vendor |
| Support and security updates | Large organizations are pointed to enterprise builds with SLAs and security updates from ecosystem partners | Business plan includes long-term support, an SLA, signed security updates and portal access; Enterprise adds integration support | Confirm the support tiers, patch channels and offline update delivery |
| Update handling | Test each point release in a pilot; LibreOffice 26.8.1 arrived October 2, 2026 and 26.2 stays supported until November 30, 2026 | Plan manual replica changes for each release; the 25.04 branch still received point releases in 2026 | Confirm how release packages and signatures reach the isolated network |
| Sizing and scaling | Runs on each workstation, so sizing is per device and no shared server is needed | Chart recommends 8 CPU cores and 8000 MiB memory per pod in production; autoscaling is disabled and load balancers must route by WOPISrc | Ask the vendor for production sizing and scaling guidance before ordering hardware |
How to deploy LibreOffice and Collabora Online without internet access
This sequence moves LibreOffice and Collabora Online into a restricted network through a controlled transfer, then keeps both on a maintenance cycle the security team can verify. The result is an internal desktop and browser editing service that does not depend on outside connections at run time.
Build the staging network and inventory components
The platform team sets up a connected staging network that matches the production image and OS baseline, then lists every component to carry across: the LibreOffice desktop packages, the Collabora Online container image, the Helm chart, the ingress controller, and any OS packages or fonts those depend on. Record each name, version and checksum in a bill of materials that the security team reviews before any transfer. Done when the list is approved and each item has a recorded hash.
Mirror packages into an internal repository
On the staging network, the team downloads the approved LibreOffice builds and the operating system packages they depend on, then publishes them to an internal package repository that the restricted network can reach. Ask the vendor or your ecosystem partner which builds are suitable for your OS and whether an enterprise build with support terms fits your policy. Done when a test machine on an isolated segment installs LibreOffice from the internal repository alone.
Mirror Collabora Online images and the Helm chart
The team pulls the Collabora Online container image (collabora/code for the free CODE edition, or the image supplied with an enterprise subscription) and the official Helm chart from the upstream repository on the staging network. It then pushes both into the internal container registry and records the image digest. Confirm the image tag and architecture (x86-64, ppc64 or arm64) match your cluster nodes. Done when the cluster pulls the image from the internal registry with no outbound route.
Configure replicas and WOPI routing in the chart
The platform engineer sets the replica count manually in the values file, because the official chart README says horizontal pod autoscaling is disabled since scaling breaks collaborative editing and copy and paste. The load balancer or ingress (Nginx, HAProxy or OpenShift Router are supported) must route requests by the WOPISrc parameter, so every user editing one document reaches the same pod. Set requests to 4 CPU cores and 6000 MiB of memory per pod and limits to 8 cores and 8000 MiB, as the chart README recommends for production. Done when a two-user test session on one document lands on the same pod.
Verify the bundle and transfer it across the boundary
The security team re-checks the checksums and digests against the bill of materials, scans the packages and images with the tools approved for the enclave, and documents the result. Only then is the approved bundle moved across the boundary using your controlled media or cross-domain process. Record who approved the transfer, when, and the hash values. This supports the supply chain integrity expectations in NERC CIP-013-2 where that standard applies. Done when the restricted environment's hashes match the staging record.
Deploy and integrate the offline service
The team loads the images into the restricted registry, installs the Helm release, and connects Collabora Online to the document host (for example, Nextcloud or another WOPI host) inside the enclave. Test opening, editing and saving .docx, .xlsx and .pptx files, and confirm no call leaves the network. Confirm the WOPI integration steps with the host's documentation for your version. Done when test documents round-trip with no outbound traffic in the firewall logs.
Run the offline update cycle with branch selection
Each update cycle starts on staging. For LibreOffice, production users can stay on the 26.2 branch, which The Document Foundation says is supported until November 30, 2026. The 26.8 family, with 26.8.1 as its first maintenance release, is the newer option, and the team chooses between them based on support dates and tested compatibility with their macros and templates. For Collabora Online, the team checks the release notes for the branch in use and moves to a newer point release only after testing. Repeat the bundle, verification and transfer steps for each update. Done when the change record shows the chosen branch, the tested version and the approving owner.
How activation, licensing and updates work across the boundary
LibreOffice needs no activation server, so the licensing work on an isolated network is about packaging, hashing and approving installers before they cross the boundary. Pull the installer from the official download page on a connected staging machine, record its checksum and version, scan it, and approve it in your change process. Then distribute it from an internal repository through your software deployment tool. Confirm with your security team how the approved hash is checked on the far side, because that check is the evidence a supply chain control such as NERC CIP-013-2 asks you to hold for software and patches carried into a protected environment.
Office LTSC works differently. Volume activation depends on how your Microsoft agreement and reseller arrangement are set up, and the activation method, key management and any connection needed to reach a licensing service all vary by configuration. Confirm the exact procedure with Microsoft or your reseller for your own setup, including what happens at renewal and when machines are rebuilt or moved between enclaves. Do not assume a previously working activation will survive a change of network design. Put the answers in writing before you retire any licensing path.
Collabora Online updates follow the same pattern: stage the new container image or package outside the boundary, verify it, and move it in as a controlled change. Community builds such as CODE are released as a rolling series and are not recommended for production, so a regulated deployment should be running a supported branch. The paid Collabora Online enterprise plan adds long term support, a service level agreement and signed security updates. In a regulated setting, ask whether those signatures can be verified inside your network and how fixes are delivered when no internet route exists, because an unverified patch is a risk you will have to document.
Questions buyers ask before bringing in outside help
Can our team move air-gapped desktops off Office LTSC without outside help?
Yes, many teams can, provided they have staff who know their document estate, packaging tools and the accreditation process for their network. The work splits into a desktop track (packaging LibreOffice from an internal repository, testing macros and templates, training users) and a server track if Collabora Online or ONLYOFFICE is added. Outside help usually makes sense when the team lacks people who can test converted files at volume or document the change for an assessor. Ask any partner to separate work your staff can own from work they should deliver, in writing.
What drives the cost of an air-gapped Office replacement?
The main drivers are:
- Desktop count and how many device images must be rebuilt and tested
- Server sizing if an in-browser editor runs on an internal server, including replicas, since a Collabora Online pod is recommended at 8 CPU cores and 8000 MiB of memory for production limits
- Template and macro rework, which depends on how many VBA macros and Office templates your teams rely on
- Training and help desk time
- The support tier you choose for the enterprise build
One-time work covers testing, packaging and migration. Recurring costs cover support subscriptions, patch handling and staff time. Ask each bidder to price these components separately.
How long does an air-gapped Office migration take?
Duration depends on the scope you agree, not on a fixed figure. A pilot of heavy Excel and macro users takes longer than a standard-document rollout, and every additional network zone, approval step or accreditation review adds time that no general estimate can predict. Ask for a schedule tied to named milestones: inventory complete, pilot signed off, packaging accepted in the isolated network, and cutover. Your security office's review cycle is often the longest item, so confirm it early.
What does our team need to provide for the engagement to succeed?
The client side typically supplies:
- An inventory of document types, macros, templates and external exchange formats
- Access to a representative sample of files for conversion testing
- Approval routes and accreditation contacts for the isolated network
- A process for moving approved packages across the boundary
- Named business owners who sign off pilot results
Remote access to the air-gapped environment may not be allowed, so confirm how test files and installers will move in and out before work starts.
Does ONLYOFFICE or Collabora licensing change the decision for air-gapped use?
Yes, licensing can change the design, but it does not decide it alone. Collabora Online is licensed under the Mozilla Public License 2.0, and its paid Business plan is listed at 3 euros per user per month for up to 99 users, with long term support, an SLA and signed security updates. Confirm current terms on the vendor's pricing page and ask what each option includes for offline updates. Check ONLYOFFICE's license terms and any edition restrictions for your use case with the vendor before comparing, since they can differ from Collabora's.
How do we verify that the migrated environment works and is documented?
Verification should cover three things: functional tests on a sample of converted documents, macros and templates, a review of formatting losses, and evidence that packages were checked before entering the isolated network. LibreOffice's documentation notes that converted Microsoft files may need manual reformatting in proportion to their complexity, and lists features such as pivot tables, revision marks and conditional formatting that may not convert cleanly. Agree acceptance criteria in writing. DeployOpen prepares controls and evidence for compliance assessments, but independent auditors and certification bodies issue any audit report or attestation.
How do we verify that every package we carry across the boundary is trustworthy?
Set a documented intake process that records the source, version and checksum of each package, then has a second person approve it before transfer. NERC CIP-013-2 is one example of a standard that asks procurement processes to address verification of software integrity and authenticity, and it is relevant if you operate in that sector. Ask any partner how packages are staged, scanned and logged before they reach the isolated network, and confirm that the process matches your own accreditation requirements.
Evidence assessors ask for under an offline posture
An offline network is trusted because its boundary, imports and changes are controlled and recorded. The six artifacts below are the records an assessor will usually ask to see, and they connect because each one shows what entered the network, who approved it and how it was used. DeployOpen prepares this evidence, but the assessor or certification body decides whether it is sufficient.
Approved package list with hashes
This is the inventory of every LibreOffice build, font, template and add-on allowed inside the boundary, with the version and a cryptographic hash recorded for each file. It supports the software integrity and authenticity expectations in NERC CIP-013-2 and similar supply chain controls. Check that each hash is taken from the vendor's published checksum or a verified source, and that the list is signed off by a named owner before any import.
Transfer log for each import
Every media item or transfer that crosses the air gap needs a log entry showing the date, the person who carried it, the source, the hashes checked and the approver. Assessors use these entries to test whether the boundary was enforced in practice. Confirm that the log is kept outside the systems it describes so that it cannot be edited by the people whose actions it records.
Internal repository configuration
The internal package repository and any container registry define which sources are trusted and which packages can be installed. Export the configuration files and record the mirror source, sync schedule and access rules, so an assessor can see that desktops and servers pull only from the approved mirror. Confirm how the repository is protected from unapproved uploads.
Update records
Each LibreOffice point release that enters the environment should have a record that names the release, the advisory or fix list reviewed, the test results and the date it was deployed. A release may be skipped on purpose, so record that decision too. Check that the update process matches the way the vendor announces maintenance releases and the supported branch dates.
Access logs for the internal Collabora server
If Collabora Online runs on an internal server, its access logs show who opened, edited and downloaded documents, and from which host. Keep these logs with the identity provider logs for the same period, and confirm where they are stored, how long they are retained and who can read them. Assessors will often sample these logs against user access lists.
Document exchange procedure
This written procedure describes how documents move to and from outside parties, including the approved format, the review step for macros and embedded objects, the transfer medium and who authorizes release. It should state how converted Office files are checked, since complex layouts and some objects may not convert cleanly. Test the procedure with real samples before the assessment, and record each exchange.
How DeployOpen deploys offline office suites
DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure, including air-gapped networks. For offline office suites, that means scoping the document workflows first, then building the software supply chain, editing servers and handover material that the isolated environment needs to run without internet access.
How we scope
- Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
- The written scope lists which desktop, browser and document exchange workflows the offline office suite must cover.
- We confirm the boundary rules for importing packages, updates and documents with your security team.
- Ongoing support, upgrades and testing are available as a retainer after the initial handover.
How we build
- We build an internal package repository and mirror for LibreOffice, Collabora Online or ONLYOFFICE installers and dependencies.
- We deploy the editing server inside your network and configure its document formats, fonts and templates.
- We test Microsoft format round trips, macro behavior and print output against a sample set your team approves.
- We document the integrity checks applied to every package carried across the isolated boundary.
How we hand over
- You receive installation, configuration and update runbooks written for your offline change process.
- The handover covers the procedure for importing new releases on removable media or a controlled transfer path.
- We provide evidence for supply chain and access control reviews, such as software hash records and configuration baselines.
- Administrators are trained on deployment, rollback and the known conversion limits of Microsoft formats.
How we support
- Support covers patch review, release testing and redeployment into the offline environment after your approval.
- Compliance readiness work prepares controls and evidence for assessments, while independent auditors issue any audit reports.
- Security testing of the deployed editing and file services can be scheduled as part of the retainer.
- Quotes follow from the written scope, so ask for each cost component to be itemized before approval.
