Creating Local Repo for Red hat Server

At a glance#

• Purpose: Build a local YUM/DNF repository from the RHEL installation ISO so packages can be installed without internet access or a Red Hat subscription.
• Applies to: RHEL, CentOS, Rocky and AlmaLinux 7, 8 and 9.
• Risk: Low — adds a repository, changes nothing already installed.
• Time: About 20 minutes.

Overview#

Servers in isolated network segments often have no route to the internet and no Red Hat subscription attached. Any yum install then fails with "Cannot find a valid baseurl".

The installation ISO already contains the base package set. Mounting it and pointing YUM at its contents gives you a working local repository.

Note: An ISO repository contains only the packages that shipped with that release. It receives no security updates. Use it for initial builds and dependency resolution — not as a substitute for patching. Where possible, mirror an updates repository internally instead.

Before you start#

• Root access.
• The RHEL ISO matching the installed OS version exactly. Check with cat /etc/redhat-release. A 8.6 ISO on an 8.8 system will cause dependency conflicts.
• Enough free space if you plan to copy the ISO contents — typically 8–12 GB.

Check available space:

df -h /home

Procedure#

1. Attach the ISO to the VM#

In vCenter: Edit Settings → CD/DVD drive → Datastore ISO File, select the ISO, and tick Connect At Power On.

Confirm the guest can see it:

ls -l /dev/cdrom

2. Mount the ISO#

sudo mkdir -p /mnt/iso
sudo mount /dev/cdrom /mnt/iso

A read-only warning is expected and harmless.

Verify the contents:

ls /mnt/iso

You should see BaseOS, AppStream and media.repo on RHEL 8/9, or a Packages directory on RHEL 7.

3. Copy the contents to local disk#

Copying decouples the repository from the CD drive, so it survives the ISO being disconnected.

sudo mkdir -p /opt/localrepo
sudo cp -rv /mnt/iso/* /opt/localrepo/

Note: To skip the copy and use the mount directly, set baseurl=file:///mnt/iso/ in step 4. The repository then breaks whenever the ISO is disconnected, and does not survive a reboot unless you add it to /etc/fstab. Copying is more reliable.

4. Create the repository definition#

The file layout differs between major versions.

RHEL/CentOS 8 and 9 — two repositories are required:

sudo nano /etc/yum.repos.d/local.repo

[localrepo-baseos]
name=Local Repository - BaseOS
baseurl=file:///opt/localrepo/BaseOS/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

[localrepo-appstream]
name=Local Repository - AppStream
baseurl=file:///opt/localrepo/AppStream/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release

RHEL/CentOS 7 — a single repository:

[localrepo]
name=Local Repository
baseurl=file:///opt/localrepo/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-7

Note: Keep gpgcheck=1. Setting it to 0 disables signature verification on every package installed from this repository. The GPG key is on the ISO, so there is no reason to turn it off. If the key path differs, find it with ls /etc/pki/rpm-gpg/.

5. Disable the online repositories#

If the server has no internet route, leaving them enabled makes every YUM command wait for a timeout first.

sudo mkdir -p /etc/yum.repos.d/disabled
sudo mv /etc/yum.repos.d/CentOS-*.repo /etc/yum.repos.d/disabled/ 2>/dev/null
sudo mv /etc/yum.repos.d/redhat.repo /etc/yum.repos.d/disabled/ 2>/dev/null

Moving them rather than deleting means they can be restored later.

6. Refresh the cache#

sudo yum clean all
sudo yum repolist

Verification#

sudo yum repolist

Your local repositories should be listed with a package count greater than zero:

repo id                    repo name                          status
localrepo-appstream        Local Repository - AppStream       4,672
localrepo-baseos           Local Repository - BaseOS          1,658

Test an actual install:

sudo yum install -y tree
tree --version

Making the mount persistent#

Only needed if you chose to point at /mnt/iso rather than copying.

echo '/dev/cdrom  /mnt/iso  iso9660  loop,ro,nofail  0 0' | sudo tee -a /etc/fstab
sudo mount -a

Warning: The nofail option matters. Without it, the server will refuse to boot if the ISO is not attached.

Troubleshooting#

Related#

• Hardening Linux Server
• RHEL 6 Filesystem Recovery and Root Password Reset