Offline Rust builds: 17,527 downloads, almost nobody is shutdown-ready

Short answer: You can build Rust with zero internet, but only if you vendored your crates and mirrored your toolchain before the cable got cut. Our crates.io pull on Oct 26 2026 shows the six tools that do this were downloaded 17,527 times in 90 days, while cargo-chef, a tool that assumes the internet is always there, was downloaded 1,218,032 times. That is a 69 to 1 bet that the network never goes away.

TL;DR: Iran ran an 88-day national internet blackout in 2026, and its datacenters still had no international access as of July, so "what if crates.io disappears" is not a thought experiment for millions of developers. cargo-local-registry is the clear winner of the offline tools with 10,235 downloads in 90 days, its weekly downloads rose 64% from August to October, and cargo-vendor-filterer tripled in the first week of October. The full-mirror option, panamax, has not shipped a release in 28 months and pulled 116 downloads, so the moment to set up your offline path is now, while you still have a connection to copy from.

Key numbers

What	Number	Source, checked Oct 26 2026
Iran blackout length before partial restore (end of May 2026)	88 days	Wikipedia, Internet censorship in Iran
Downloads of 6 offline Rust tools, last 90 days	17,527	crates.io API
cargo-chef downloads, last 90 days	1,218,032	crates.io API
cargo-local-registry, weekly downloads, Aug avg vs Oct avg	654 to 1,076 (+64%)	crates.io daily downloads
Months since panamax (crates.io mirror) last release	28 (June 6 2024)	crates.io API
Crates on crates.io	362,129	crates.io summary API

The question nobody asks until the network dies

A thread on r/rust this weekend asked a blunt question: what repos and tools let you do fully offline Rust builds and deployments, "like Iran internet shutdown". It hit 85 upvotes in hours, which tells you it is not a hobby question.

Iran is the live case. On January 8 2026 the government imposed a total blackout that took international traffic to about 1% of normal, per Cloudflare and NetBlocks monitoring summarised on Wikipedia. It lasted 88 days before a partial restore at the end of May.

Datacenters, the place your CI runner and build box live, still had no international access as of July 2026. In October the regime started dropping UDP and cutting access to Cloudflare. If your build pulls from crates.io, static.rust-lang.org or GitHub, your build was dead the whole time.

Why Rust is extra exposed

Cargo is wonderful right up until it cannot reach the index. A fresh cargo build needs three things from the internet: the toolchain from rustup, the crates.io index, and every crate tarball in your lockfile.

Direct dependencies understate the bill. On Oct 26 axum 0.8.9 listed 17 required direct dependencies and reqwest 0.13.5 listed 21, before you count what those pull in. One shutdown and every one of them is a 404 you cannot fix.

There are 362,129 crates on crates.io and 512.8 billion downloads served. That convenience is the trap: the ecosystem is built on the assumption that the registry is one HTTPS call away, forever.

By the numbers: the tools people actually use

We pulled every offline-build crate we could find from the crates.io API on Oct 26 2026. The full table is in the download below.

• cargo-local-registry (10,235 downloads in 90 days): turns your lockfile into a local registry directory you can point Cargo at. Last release March 2026. This is the default answer.
• cargo-vendor-filterer (7,073): a smarter cargo vendor from the CoreOS folks that drops crates for platforms you never build. Pushed Oct 8 2026.
• panamax (116): mirrors all of crates.io plus rustup toolchains. 566 GitHub stars, last release June 6 2024.
• ktra (37), cargo-offline (59), freighter-server (7): private registries and wrappers, effectively abandoned by downloads.

The built-in cargo vendor command does not show up in any download count because it ships with Cargo. It is still the first move for most teams.

Follow the money: who wins when the internet stays up

cargo-chef pulled 1,218,032 downloads in the same 90 days. It caches dependency layers in Docker so CI is fast, and it assumes the network is fine. That is 69 times the downloads of all six offline tools combined.

That gap is the whole industry's bet. Cloud CI vendors, registries and hosted runners get paid for every fetch, so "always online" is the default they sell. Nobody bills you for the build that works with the cable unplugged.

The losers are the developers in Tehran, in the next country that flips the switch, and in every air-gapped defense or hospital shop that found out its supply chain was a URL. Our bet: the next big shutdown makes offline-first a checklist item, the same way Log4Shell made SBOMs one.

What breaks first, in order

When the link drops, the failures arrive in a predictable order. Knowing it tells you what to protect first.

• New dependencies die instantly. Any crate not already in ~/.cargo/registry cannot be added. Feature work that needs a new crate stops on day one.
• Fresh CI runners die next. Ephemeral runners start with an empty cache, so every job tries to fetch the whole lockfile and fails.
• Toolchain updates stop. rustup cannot reach static.rust-lang.org, so you are frozen on whatever compiler each machine already has, and new machines get nothing.
• Git dependencies fail quietly. Anything in Cargo.toml pointing at a GitHub URL breaks even when the crates.io copies are cached.
• Laptops survive longest. A developer machine with a warm cache can keep building the code it already built, which is why teams feel fine for a day and then realise production deploys are impossible.

The fix for all five is the same: a vendored directory or local registry you control, checked into the repo or the base image.

The demand is already moving

Full weeks only, cargo-local-registry averaged 654 downloads a week in August and 1,076 a week across the three October weeks, up 64%. cargo-vendor-filterer sat near 407 a week from August through September, then jumped to 1,382 in the week of Oct 5.

Downloads include CI bots, so read the trend, not the absolute count. Still, both lines bend up in the same month Iran started throttling again, and nobody has proven that is a coincidence.

What this means for you: build the offline path in one afternoon

Do it while you still have a connection to copy from. The steps:

1. Vendor: run cargo vendor vendor/ (or cargo-vendor-filterer to skip other platforms) and paste the printed [source] block into .cargo/config.toml.
2. Prove it: build with cargo build --offline --locked on a machine with networking off. If it fails, you are not offline yet.
3. Toolchain: keep the rustup standalone installer for your pinned version, or a panamax mirror if you serve a whole team.
4. Containers: bake the vendor directory into a base image so CI never needs crates.io.
5. Repeat: re-vendor on every lockfile change, or your offline copy quietly rots.

More Rust data in our Rust hub, the crate tracker and the Rust article archive, including our crates.io vs PyPI PDF download study.

If you would rather not spend the afternoon, our paid fix gets your Rust project building with the network unplugged: fixed within 24 hours or a full refund.

Sources

• crates.io, summary API and per-crate download APIs, pulled Oct 26 2026
• Wikipedia, Internet censorship in Iran (Cloudflare and NetBlocks figures), read Oct 26 2026
• r/rust, Repos/tools for fully offline Rust builds and deployments, Oct 2026
• GitHub, panamax-rs/panamax, checked Oct 26 2026
• GitHub, coreos/cargo-vendor-filterer, checked Oct 26 2026
• The Cargo Book, cargo vendor, checked Oct 26 2026