Skip to content

Installing packages

The TVS SDE does not have direct internet access. All package installation goes through one of two routes: the Nexus package proxy, which is available automatically on your VM, or the airlock, for packages not available through Nexus.

What is Nexus?

Nexus is a package repository manager running inside the TRE. It acts as a proxy between your VM and the public package repositories (PyPI, CRAN, conda, apt, and others). When you install a package, your VM contacts Nexus rather than the internet directly. Nexus fetches the package from the internet on your behalf, caches it, and serves it to your VM.

This means that for most common packages, installation works exactly as it would outside the TRE — you use the same commands you are already familiar with (pip install, conda install, install.packages() etc.) and Nexus handles the rest transparently.

Licence-activated software

Any software that requires internet access to activate a licence will not work inside the TRE. There is no outbound internet access from your VM, so licence checks and activation calls will fail. If you need commercial software, contact the TVS SDE team to discuss options.

What is available through Nexus?

The following package repositories are proxied through Nexus and available on your VM without any additional setup:

Repository Format What it provides
pypi PyPI Python packages via pip
conda-mirror conda Conda packages (mirrored from upstream)
conda-repo conda Conda packages (additional hosted packages)
r-proxy R R packages via install.packages()
ubuntu apt Ubuntu system packages
ubuntu-security apt Ubuntu security updates
microsoft-apt apt Microsoft apt packages (e.g. VS Code, Azure CLI)
docker-hub Docker Docker images from Docker Hub
almalinux yum AlmaLinux packages
fedoraproject yum Fedora packages
microsoft-yumrepos yum Microsoft yum packages
microsoft-download raw Microsoft downloads
microsoft-keys raw Microsoft signing keys
r-studio-download raw RStudio downloads
snapcraft raw Snap packages

VS Code extensions

The vscode-extensions proxy is listed in Nexus but is not currently working for extension installation. If you need a VS Code extension that is not already installed, use the airlock route below.

Installing packages via Nexus

Your VM is pre-configured to use Nexus for all package managers. You do not need to change any settings — just use the standard install commands.

Python (pip)

pip install pandas
pip install numpy scipy matplotlib

Conda

conda install numpy
conda install -c conda-forge scikit-learn

R

In R or RStudio:

install.packages("ggplot2")
install.packages(c("dplyr", "tidyr", "lubridate"))

R on Windows

If R package installation fails on Windows with a certificate or download error, this is usually caused by Windows attempting to verify certificate revocation lists (which requires internet access). The fix is to add the following to your R session before installing: 

options(download.file.method = "libcurl")
This is already configured in the system Rprofile.site on OUH VMs — if you are seeing errors, check whether you have overridden this setting in your own .Rprofile.

System packages (Linux)

sudo apt-get install htop
sudo apt-get install libgdal-dev

Docker (Linux VMs)

docker pull python:3.11
docker pull ubuntu:22.04

Installing packages via the airlock

If a package you need is not available through Nexus — for example, a specialist package not on PyPI or CRAN, a specific wheel file, or a package that requires a non-standard index — you can bring it in through the airlock.

When to use the airlock route

  • The package is not found via pip install or conda install
  • You need a specific version that is not cached in Nexus
  • You need a wheel file built for a specific platform (e.g. CUDA wheels for GPU workloads)
  • You need a package from a non-standard index (e.g. PyTorch CUDA builds)

How to request a package via airlock

  1. Download the package file(s) on a machine outside the TRE. For pip packages this is typically a .whl file: 

    pip download <package-name> --dest ./packages
    For packages with dependencies, download all of them: 
    pip download <package-name> --dest ./packages --platform manylinux2014_x86_64 --only-binary=:all:

  2. Submit an airlock import request through your workspace GitHub repository, following the standard airlock process. Include the package files as the import payload.

  3. Once approved, the files will appear in your airlock import area inside the TRE.

  4. Install from the local file: 

    pip install /path/to/package.whl
    Or for a directory of wheels: 
    pip install --no-index --find-links /path/to/packages/ <package-name>

Raising an airlock request

Airlock requests must be raised as a GitHub issue in your workspace repository. See the Airlock requests page for full details.

Not sure which route to try first?

Try pip install or install.packages() first — if the package is on PyPI or CRAN it will very likely work via Nexus without any extra steps. If the install fails with a connection error or a "package not found" message, use the airlock route.

If you are unsure, contact the TVS SDE team.