One registry for every package your builds produce: OpenArtifact stores and serves 23 artifact formats behind a single URL scheme and permission model on infrastructure you control. Create hosted repositories for the packages you publish, proxy repositories that cache upstream registries and keep serving when they go down, and group repositories that merge members in order behind one address. Point Maven, npm, PyPI, Docker and OCI clients, Helm, Cargo, NuGet, Go, RubyGems, Debian, RPM, and a dozen more tools at it with their native protocols, no plugins or wrappers. Control who can publish and pull with users, groups, permission targets, and API tokens, sign people in through OIDC or SAML single sign-on, and give CI tokenless login through OIDC token exchange. Scan what you store: software bills of materials in CycloneDX and SPDX, vulnerability findings from OSV, Trivy, and Grype, license compliance checks, and secret detection run against your artifacts. Set cleanup policies and storage quotas so old snapshots stop eating disk, attach custom properties to artifacts, and promote release bundles through your pipeline stages. Store blobs on a local filesystem, S3, Google Cloud Storage, Azure, Garage, SeaweedFS, or an OCI registry, federate selected formats between instances, and import an existing Nexus or Artifactory server with the oa command line tool. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Trusted by millions of developers and integrated into CI/CD pipelines at organizations worldwide, Sonatype Nexus Repository is the industry-standard binary artifact repository manager that stores, organizes, and distributes software components across every major package ecosystem. Community Edition supports over 20 formats including Maven for Java builds, npm for JavaScript packages, Docker for container images, PyPI for Python libraries, NuGet for .NET assemblies, Helm for Kubernetes charts, Go modules, RubyGems, Cargo for Rust crates, Conda for data science environments, APT for Debian packages, Yum for RPM distributions, and Hugging Face for AI/ML models. Three repository types serve different needs: hosted repositories store internally-produced artifacts, proxy repositories cache remote registries like Maven Central, npmjs.org, and Docker Hub reducing bandwidth and improving build reliability, and group repositories aggregate multiple hosted and proxy repositories behind a single URL endpoint. The web UI provides component browsing and search, repository configuration, blob store management with configurable cleanup policies, and direct artifact upload via drag-and-drop. Role-based access control enforces fine-grained permissions per repository with configurable security realms, while the comprehensive REST API enables automated repository provisioning, component management, and integration with Jenkins, GitHub Actions, GitLab CI, and Azure DevOps. External PostgreSQL database support enables Kubernetes deployments with improved backup, restore, and horizontal scaling capabilities. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Eclipse Public License 1.0 licensed.

One server can hold every package your builds pull, publish, and cache, so the team stops juggling a different registry for every language. Astrum Repository hosts your own artifacts, proxies public registries so builds keep working when an upstream is down, and groups both behind a single address your tools already understand. Thirty-nine formats share that address: Docker and OCI images, Maven, npm, PyPI, Cargo, Go modules, Helm charts, NuGet, Terraform modules, APT and Yum packages, Hugging Face models, browser extensions, Git LFS, and even remote caches for Nx and Turborepo. Blob storage grows with you, moving between disk, S3, and agent-connected stores that combine into groups without relocating data. Access stays deliberate through users, roles, privileges, and content selectors, with LDAP and OpenID Connect sign-in and access tokens minted for CI pipelines. Day-to-day operations are visible rather than guessed: health endpoints, Prometheus metrics, scheduled tasks, cleanup policies, audit trails, and backups are built in, and several servers can share one database when a single node is no longer enough. The web interface speaks twelve languages, so a platform team spread across regions still works in one console. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

One trusted home for every package your build pipeline consumes: kkRepo hosts, proxies, and groups artifacts for Maven, npm, PyPI, Docker and OCI, Helm, Cargo, Go, NuGet, Composer, Terraform, Conda, APT, Conan, RubyGems, Yum, and more than twenty formats in total. Point your existing Nexus clients at it and nothing changes, because repository domains, the /repository/ URL layout, and the permission model carry over, and a one-click migration moves hosted data while clients keep building. Upstream proxies can be tuned per repository with their own outbound proxy and credentials, group repositories present many sources as one endpoint, and cleanup policies retire old artifacts before disks fill. Every stored artifact can be scanned against known vulnerabilities with SBOM generation and download enforcement, while Local, LDAP, and OIDC sign-in with fine-grained permissions decides who may publish or pull. Prometheus metrics and ready Grafana dashboards show throughput and storage, and multi-replica deployments share state through MySQL or PostgreSQL with blobs in S3-compatible storage. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Artifact Keeper serves as a self-hosted universal software artifact repository that consolidates container images, application libraries, and infrastructure bundles under a unified management control plane. Software development teams can publish and resolve dependencies using their existing build tools, including Docker, Helm, npm, PyPI, Maven, Cargo, NuGet, and Terraform without installing proprietary client plugins. Remote repositories act as transparent pull-through caching proxies for public upstreams like Docker Hub and PyPI, accelerating internal CI/CD build speeds while insulating production pipelines from external registry outages. Virtual repositories combine multiple local, remote, and third-party endpoints into single URLs, resolving packages across prioritized internal teams and public registries automatically. Automated security scanners evaluate incoming packages for Common Vulnerabilities and Exposures using Trivy and Grype engines, assigning letter grades and enforcing quarantine policies to block vulnerable binaries before production release. Administrators can sign package metadata with cryptographic GPG keys, configure peer mesh replication across geographic regions, and manage team permissions using OpenID Connect, SAML, and granular access tokens. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Public registries rate-limit your CI, log every pull, and pick the worst moment to go down; Nora replaces that dependency with a self-hosted artifact registry that hosts and caches seventeen package formats behind a single address. Point Docker, Maven, npm, pip, Cargo, and eleven other clients at one endpoint, and Nora serves your private artifacts while transparently caching upstream packages fetched from Docker Hub, Maven Central, npmjs, and crates.io. Each base image or library downloads once and is then served locally, so builds get faster, stop tripping rate limits, and survive upstream outages. Curation rules decide what is allowed to reach your builds: allowlists and blocklists filter packages by name, minimum release-age rules hold back freshly published versions, and new digests can wait in quarantine until approved. Anything you publish keeps its name: a hosted package is never silently replaced by an upstream package sharing it. Pipelines publish without stored secrets through OIDC identity from GitHub Actions and GitLab CI, and API tokens with read, write, and admin roles cover the rest. A web dashboard shows downloads, cache hit rates, storage usage, and recent activity for every registry, and audit logs plus Prometheus metrics feed your monitoring. For disconnected networks, a mirror command prefetches whatever your lockfiles name, an import tool migrates Artifactory or Nexus repositories, and backup and restore keep a spare copy. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Stop hunting for a public mirror that still works this week: MirrorProxy puts every software source your builds depend on behind one domain you control, so GitHub releases, container images, npm and PyPI packages, and operating-system repositories all come from the same stable gateway. Point it at a source and it fetches and caches on demand, with no full mirror to store or sync, and when an upstream times out or starts rate-limiting, it fails over to the next endpoint and keeps your builds moving. Around thirty adapter types cover the everyday sprawl: Docker Hub and nine other registries, Cargo and Go modules, Maven and NuGet, Homebrew and WinGet, and more than thirty Linux and BSD distributions, plus custom static repositories you define yourself. Sharing the gateway is safe: invite users, set monthly quotas per person or team, restrict which sources each team may use, and gate access with rate limits and IP rules, while the console shows traffic trends, visitor regions, cache behavior, and the health of every source. Email and webhook alerts warn you before a quota runs out or an upstream outage drags on, and the cross-platform client switches a workstation's sources to your gateway and back. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Private npm packages without shipping code to the public registry or paying for npm Enterprise: Verdaccio is the standard lightweight, zero-config private registry and caching proxy. It runs as a single Node.js process with its own tiny embedded database; no external database is required to start. Point npm, yarn, or pnpm at it and everything behaves as expected: install, publish, unpublish, dist-tags, and deprecation all work against the standard npm endpoints. The uplink system is where it earns its keep: packages not found locally are fetched from configured upstreams (npmjs.org, yarn, JFrog, Nexus, or another Verdaccio), cached as tarballs, and served locally thereafter - cutting CI latency and surviving registry outages. Multiple uplinks chain for failover, and per-package glob patterns in config.yaml route scopes to specific upstreams while controlling access, publish, and unpublish rights per group. You can even override a public package by publishing a patched version under the same name locally. A plugin architecture swaps in auth backends (htpasswd default, LDAP and others available), storage drivers (S3, Google Cloud Storage), middleware routes, and metadata filters. With official Docker images and a Kubernetes Helm chart, it slots into any pipeline in minutes.

The first container registry to reach CNCF graduated status with over 29,000 GitHub stars since VMware open-sourced it in 2016, Harbor transforms the basic Docker Distribution into a hardened enterprise registry with vulnerability scanning, supply chain signing, multi-datacenter replication, and project-level access control out of the box. Trivy scans every pushed image against the NVD, GitHub Advisory Database, and distribution-specific vulnerability feeds, with scan-on-push policies that block deployment of images exceeding configurable severity thresholds. Artifact signing through Cosign keyless signatures and Notation enforces content trust policies ensuring only cryptographically verified images reach production clusters. Policy-based replication synchronizes images and Helm charts between Harbor instances across multiple datacenters using repository, tag, and label filters with automatic retry and bandwidth throttling — enabling hybrid-cloud and disaster-recovery topologies. The RBAC model isolates projects with per-project quotas, robot accounts for CI/CD automation, webhook notifications, and audit logging that tracks every pull, push, delete, and configuration change. LDAP, Active Directory, and OIDC authentication integrate with existing identity providers, while the proxy cache transparently caches images from Docker Hub, Quay, and other upstream registries to reduce pull latency and rate-limit exposure. The RESTful API with embedded Swagger UI, tag retention policies, garbage collection scheduling, and immutable artifact rules complete the lifecycle management. Deploy via Docker Compose or Helm Chart on Kubernetes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Think of Zot as the registry equivalent of a well-run warehouse: OCI images and artifacts come in, get cataloged, checked, and shipped back out to any compliant client. The bundled web interface lets you browse repositories and tags, inspect image details, and copy ready-made pull commands for Docker, Podman, and Skopeo instead of memorizing registry URLs. Sync extensions mirror upstream registries such as Docker Hub on a schedule or on demand, which keeps air-gapped and rate-limited environments supplied without manual image ferrying. Scrubbing walks the storage in the background comparing blocks against their SHA-256 checksums, so silent bit-rot gets caught by the registry instead of by a failed production deploy. Signature verification with Cosign and Notation checks that images came from who they claim, search answers queries across the catalog, and CVE scanning flags vulnerable images before they spread. Prometheus metrics, a management API, and webhook events cover the operations side, while the minimal image strips everything but the distribution spec for embedded or high-security deployments. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Instead of querying a private registry with curl and its HTTP API, open Docker Registry UI and click through repositories, tags, digests, and layers in a browser. The catalog groups images by namespace, shows tag counts, and filters as you type in the search bar, which Ctrl+F or F3 focuses. Each repository's tag list shows creation date, size, content digest, and CPU architecture, sorts numerically, and copies a ready-made pull reference with one click. A history page expands any tag into its operating system, entrypoint, environment variables, exposed ports, and layer-by-layer build steps, and a Dockerfile view reconstructs the file from those steps. The same view also covers multi-architecture images and OCI Helm exports. When the registry allows deletion, tags go one at a time or in bulk with checkboxes, Alt+Click for a whole page, and Shift+Click for a range. One interface can switch between several registries from its menu, or be locked to a single registry with your own title. Basic authentication passes through the browser, and a built-in proxy option forwards requests to your registry container so CORS needs no configuration. Light, dark, and automatic themes come with color variables for custom branding, and a weekly notice announces newer releases. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

With over 57,000 GitHub stars and deployment across thousands of organizations worldwide, Gitea is the most popular self-hosted Git service, delivering a complete software development platform in a single Go binary that runs on as little as 512MB of RAM. The platform provides full repository management with pull requests featuring inline code review, branch protection rules, merge strategies including squash, rebase, and merge commit, and automated status checks through Gitea Actions. The built-in CI/CD system uses the same YAML workflow syntax as GitHub Actions and can directly reuse over 20,000 existing Actions plugins, allowing teams to migrate from GitHub with minimal pipeline rewrites using the open-source act_runner executor. The integrated package registry supports over 20 formats including npm, PyPI, Maven, NuGet, Cargo, Helm, Composer, Conda, RubyGems, Pub, and an OCI-compatible Container registry for Docker images with no additional configuration required. Project management features include issue tracking with labels, milestones, dependencies, and time tracking, alongside kanban project boards for visual workflow management. Gitea supports LFS for large file storage, built-in wiki pages per repository, webhook integrations with Slack, Discord, Telegram, Microsoft Teams, and custom HTTP endpoints, and OAuth2 authentication with LDAP, SAML, and PAM backend support. Repository mirroring enables bidirectional synchronization with GitHub, GitLab, and Bitbucket, while the comprehensive REST and GraphQL APIs power external integrations and the official tea CLI tool. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Used by over 100,000 organizations and ranked first in the Gartner Magic Quadrant for DevOps Platforms, GitLab is the open-core DevSecOps platform that delivers the complete software development lifecycle — from planning and source code management through CI/CD, security scanning, and monitoring — in a single self-managed application. The built-in CI/CD engine executes pipelines defined in YAML with parallel jobs, directed acyclic graph scheduling, multi-project pipelines, and auto-scaling runners on Docker, Kubernetes, or bare metal. Merge requests provide inline code review with approval rules, code owners, merge trains for serialized merging, and five merge strategies including fast-forward and semi-linear history. The integrated container registry stores Docker images alongside code, while the package registry supports npm, Maven, NuGet, PyPI, Conan, Go, and generic packages. Issue boards with epics, milestones, and labels enable agile planning, while the built-in wiki and GitLab Pages provide documentation hosting and static site publishing. Security scanning in the Community Edition includes basic SAST, secret detection, and container scanning running as pipeline jobs. The Omnibus installer bundles Rails, Puma, Gitaly, Workhorse, Nginx, PostgreSQL, Redis, Sidekiq, and Prometheus into a single package installable in minutes, while Docker and Helm chart options support containerized and Kubernetes deployments. GitLab Duo AI assists with code suggestions, merge request summaries, and vulnerability resolution. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Governed by the non-profit Codeberg e.V. with over 150 contributors and quarterly major releases reaching v16.0 in July 2026, Forgejo delivers a complete code collaboration platform in a single Go binary that runs comfortably on 512 MB of RAM — providing full Git hosting with SSH and HTTPS, pull requests with inline code review, issue tracking with labels and milestones, kanban project boards, wikis, and an integrated package registry supporting Docker, npm, PyPI, Maven, NuGet, and Cargo. Forgejo Actions provides GitHub Actions-compatible CI/CD with reusable workflows, OpenID Connect for secure third-party access, ephemeral runners for autoscaling, and dynamic matrix support for complex build pipelines. The platform implements ActivityPub-based forge federation allowing issues, pull requests, and stars to work across independent instances — enabling a decentralized development ecosystem similar to how Mastodon federates social networks. Organizations and team permissions provide fine-grained access control, while LDAP, OAuth2, and OpenID authentication integrate with existing identity infrastructure. Code search indexes repositories for fast discovery, LFS handles large files efficiently, and mirror synchronization imports repositories from GitHub, GitLab, and other forges. Deploy via a single static binary, Docker container, or official Helm charts with SQLite for small instances or PostgreSQL and MySQL for production workloads. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. GPLv3+ licensed.

Cupdate keeps a watchful eye on every container image you run, reporting which ones are outdated or vulnerable while deliberately never touching the update button itself. Point it at a Kubernetes cluster, a Docker socket, or Podman hosts (local or remote, one or several) and it inventories every image in use with no configuration to write. Each image is matched against its registry to find the newest available version, and the dashboard shows the gap between what you deployed and what you could be running, with release notes inline so the decision to upgrade takes seconds instead of a changelog hunt. Vulnerability data is layered on top from four sources: Docker Scout for Docker Hub images, Clair for participating Quay images, GitHub Advisories for images tied to repositories, and osv.dev correlation for images shipping SBOMs. A dependency graph explains why each image exists in your stack by showing which workloads pull it, which ends the "can I delete this?" guessing game. Subscribe to the RSS feed to hear about new releases passively, query the REST API to drive scripts that update compose files or kustomizations, or surface outdated and vulnerable counts in a Homepage dashboard widget. Prometheus metrics and traces are available when you want the watcher itself watched. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.