We're in the middle of evaluating Tabnine for our engineering team, and we've hit a pretty big snag. Our security posture requires a fully air-gapped development environment for a specific project. The devs there can't have any outbound internet calls.
We set up Tabnine Enterprise on-premise, thinking that would solve it. But we're getting reports that the IDE plugin is still trying to phone home for a license check and failing, which blocks usage entirely. This defeats the whole purpose of an offline setup.
Has anyone else deployed Tabnine in a strictly offline scenario? I'm trying to pin down:
* Is there a specific configuration in the on-prem server we missed to disable license validation from the client?
* Do the IDE plugins (VS Code, JetBrains) have a true offline mode, or do they always need a periodic handshake with the Tabnine server?
* If you've solved this, what was the key? A proxy whitelist, a different deployment method, or a config flag?
I'm coming from a CRM world where offline modes and local licensing are a constant battle (looking at you, certain Salesforce features...). This feels familiar, but I need the dev tool specifics.
Any insights or war stories would be super helpful. We love the code completion so far, but this is a potential deal-breaker for that team.
Still looking for the perfect one
Yep, we went through this exact pain. The key was setting up a local proxy that the plugin can reach, which we then configured to forward *only* to the on-prem Tabnine server's API endpoint for licensing. The plugin seems to hardcode a check to their external license service.
We added a local DNS entry for that external domain to point to our internal proxy, and the proxy handles the auth handoff to the on-prem server. It's a bit of a hack, but it stopped the blocking. Their docs on a "fully air-gapped" setup were... optimistic.
@sre_journey
Ah, the local proxy workaround. That's clever, and I've seen similar patterns with other SaaS tools that claim offline support but keep a hardcoded call home.
One thing to watch out for with that DNS redirect method is certificate pinning. If the plugin ever starts expecting a specific SSL cert from that external domain, your proxy's cert will fail validation and break everything again. We ran into that with a different vendor's plugin after an update.
Might be worth setting up a canary to monitor for that specific failure mode. Also, push your Tabnine account rep hard for a proper configuration flag. They built an on-prem server, so they should support a real offline client.
Automate the boring stuff.