Self-hosted artifact repository for many package formats.
One Go binary, embedded web UI, PostgreSQL. Hosted, proxy and group repositories with RBAC, SSO and security scanning.

Quickstart · Formats · Configuration · Website · Documentation · Contributing

OpenArtifact stores and serves Alpine (apk), Ansible collections, Arch Linux (pacman), Cargo, Composer (PHP), Conan, Conda, Debian, Docker/OCI, Go, Helm, Hugging Face (proxy), Ivy, Maven, Nix, npm, NuGet, PyPI, raw files, RPM, RubyGems, sbt and Terraform/OpenTofu behind one URL scheme and one permission model, on your own infrastructure. Free software under the AGPL.

Hosted, proxy (read-only mirror of an upstream) and group (ordered members, first hit wins) repositories are available for 22 of the 23 formats; Hugging Face has no hosted repositories. Docker/OCI proxies and groups are served under /v2/. Federation between instances covers cargo, docker, go, helm, maven, npm, nuget, pypi and raw (federation).

Client URLs and setup per format: docs/formats.

• Native client protocols for Maven, npm, PyPI, Docker/OCI, Helm and more (see the format matrix); hosted, proxy (serve-stale, minimum age, curation) and group repositories
• RBAC with users, groups, permission targets and API tokens; SSO via OIDC and SAML; projects; service accounts and tokenless CI login through OIDC token exchange
• SBOM (CycloneDX/SPDX), vulnerability scanning (OSV, Trivy, Grype), license compliance, secret detection
• Cleanup policies, storage quotas, artifact properties, release bundles with promotion pipelines
• Blob storage on filesystem, S3, GCS, Azure, Garage, SeaweedFS or an OCI registry; backups
• GPG-signed APT and RPM metadata; signed, attested release images
• Webhooks, audit log, repository activity, Prometheus metrics, REST API with OpenAPI spec and a self-hosted interactive API reference
• oa CLI with Nexus/Artifactory import and declarative oa apply; optional MCP server and AI analysis (both off by default)

You need Docker with Compose, make and openssl.

cp docker/.env.example docker/.env
for k in POSTGRES_PASSWORD OPENARTIFACT_SECRET_KEY AUTH_HMAC_KEY; do
  sed -i "s|^$k=.*|$k=$(openssl rand -hex 32)|" docker/.env
done
docker login dhi.io      # a free Docker ID is enough
make docker-up

Without a Docker ID, skip the login and run OPENARTIFACT_RUNTIME=distroless make docker-up instead. On macOS use sed -i ''.

The UI and API are on http://localhost:8080. The first start creates the user admin with a random password, printed once to the server log:

docker compose -f docker/docker-compose.yml logs openartifact | grep -A6 'OPENARTIFACT BOOTSTRAP'

Next: create your first repository.

On Kubernetes, install the chart with a database configured; see Helm:

helm install openartifact oci://ghcr.io/openartifact/charts/openartifact \
  --namespace openartifact --create-namespace -f my-values.yaml

More: installation, configuration.

The full page index is docs/README.md. Start here:

The documentation is published, per release, at https://openartifact.github.io/ (search, version switcher, generated configuration, metrics, CLI and REST API reference). The same pages are readable here: the full page index is docs/README.md.

• Contributing: CONTRIBUTING.md; conventions for humans and coding agents: AGENTS.md
• Security: report issues privately as described in SECURITY.md
• License: AGPL-3.0-or-later, see LICENSE
• Name and logo: see the trademark policy; to run under your own name use white-label branding