Use pip download to save every distribution your project needs into a folder, then install later with the package index disabled and that folder as the only source. The folder is called a wheelhouse, and it keeps builds working when the index is unreachable.
The two commands
The pip documentation describes pip download as performing the same resolution as pip install but saving the distributions instead of installing them. It accepts requirement files, and a destination option sets the folder. For installing, the no-index option makes pip ignore the package index, and find-links points it at your folder.
python -m pip download -r requirements.txt -d wheelhouse
python -m pip install --no-index --find-links=wheelhouse -r requirements.txt
Steps
- Pin exact versions in your requirements file, ideally with hashes, so the folder matches what you tested.
- Run the download on a machine with network access and the same Python version and platform as your target.
- Store the folder in durable storage, such as an artifact store, with a name that includes the date or release.
- In CI, install from the folder with the index disabled and fail if anything is missing.
- Rebuild the folder whenever the requirements file changes, and keep older ones for old releases.
Platform pitfalls
Wheels are built per platform and Python version. The documentation lists options to fetch for a different target, covering platform, Python version, implementation and ABI. These need either the only-binary option set to all, or the no-deps option. If a package has no wheel for your target, pip must build from source, which needs compilers and build dependencies that are not in the folder.
Plan for that case: download source distributions too, and make sure the build tools are in your image.
Keeping the wheelhouse trustworthy
- Record the hash of each file, and check them when you install.
- Scan the folder contents, not just the requirements file, since transitive packages are in there.
- Do not edit files in the folder by hand.
- Delete the folder when a package in it is found to be malicious, and rebuild after replacing it.
Wheelhouse, mirror or cache
| Option | Good for | Weak spot |
|---|---|---|
| Wheelhouse folder | Single project, air gapped builds | Manual refresh, platform specific |
| Internal mirror | Many projects, fresh machines | Needs hosting and upkeep |
| Local cache | Quick repeat installs | Empty on new runners |
Try it yourself
Click through it at your own pace, or open it full screen.
Compare the inventory with your wheelhouse listing. Every package in one should be in the other.
Safeguard produces SBOMs and scans Python dependencies, and has a free scan to try.
Quick check
Do I need hashes in the requirements file?
They are not required for pip to work, but they let you detect a changed file, which matters for a stored folder.
Can one wheelhouse serve Linux and macOS?
Only if it holds a wheel for each target. Pure Python wheels work on both, compiled ones do not.
Sources
Last reviewed: 19 October 2026.
