Artifact Keeper

An enterprise-grade, open-source artifact registry supporting 45+ package formats. Built with Rust.

Documentation | Demo | Website

Highlights

• 45+ Package Formats - Native protocol support for Maven, PyPI, NPM, Docker/OCI, Cargo, Go, Helm, and 38 more
• WASM Plugin System - Extend with custom format handlers via WebAssembly (WIT-based, Wasmtime runtime)
• Security Scanning - Automated vulnerability detection with Trivy and Grype, policy engine, quarantine workflow
• Hardened Containers - All images built on DISA STIG-approved Red Hat UBI 9 base images, non-root execution, no shell or package manager in runtime
• Borg Replication - Recursive peer mesh with swarm-based artifact distribution and P2P transfers
• Full-Text Search - OpenSearch-powered search across all repositories and artifacts
• Multi-Auth - JWT, OpenID Connect, LDAP, SAML 2.0, and API token support
• Artifactory Migration - Built-in tooling to migrate repositories, artifacts, and permissions from JFrog Artifactory
• Artifact Signing - GPG and RSA signing integrated into Debian, RPM, Alpine, and Conda handlers

System Architecture

graph LR
    Client["CLI / Package Manager / Frontend"]
    Backend["Backend<br/>Rust · Axum<br/>45+ format handlers"]
    DB[(PostgreSQL 16)]
    Storage["Storage<br/>Filesystem / S3"]
    Meili["OpenSearch<br/>Full-text search"]
    Trivy["Trivy<br/>Container & FS scanning"]
    Grype["Grype<br/>Dependency scanning"]
    OpenSCAP["OpenSCAP<br/>Compliance scanning"]
    Peer1["Peer Instance"]
    Peer2["Peer Instance"]

    Client --> Backend
    Backend --> DB
    Backend --> Storage
    Backend --> Meili
    Backend --> Trivy
    Backend --> Grype
    Backend --> OpenSCAP
    Backend <-->|Borg Replication| Peer1
    Backend <-->|Borg Replication| Peer2
    Peer1 <-->|P2P Mesh| Peer2

Backend Architecture

The backend follows a layered architecture with a middleware pipeline processing every request.

flowchart TD
    REQ["HTTP Request"] --> MW["Middleware Pipeline"]

    subgraph MW["Middleware"]
        direction LR
        CORS["CORS"] --> AUTH["Auth<br/>JWT · OIDC · LDAP<br/>SAML · API Key"]
        AUTH --> RL["Rate Limiter"]
        RL --> TRACE["Tracing<br/>+ Metrics"]
        TRACE --> DEMO["Demo Mode<br/>Guard"]
    end

    MW --> ROUTER["Router<br/>50+ route groups"]

    subgraph HANDLERS["Handler Layer"]
        FMT["Format Handlers<br/>Maven · PyPI · NPM<br/>Docker · 41 more"]
        CORE["Core Handlers<br/>Repos · Artifacts<br/>Users · Auth"]
        ADV["Advanced Handlers<br/>Security · Plugins<br/>Peers · Migration"]
    end

    ROUTER --> HANDLERS

    subgraph SERVICES["Service Layer"]
        direction LR
        ART["Artifact<br/>Service"]
        REPO["Repository<br/>Service"]
        SCAN["Scanner<br/>Service"]
        PLUG["Plugin<br/>Service"]
        SEARCH["Search<br/>Service"]
    end

    HANDLERS --> SERVICES

    subgraph DATA["Data Layer"]
        direction LR
        PG[(PostgreSQL)]
        FS["Storage<br/>FS / S3"]
        MS["OpenSearch"]
        SC["Trivy / Grype / OpenSCAP"]
    end

    SERVICES --> DATA

Supported Package Formats

45+ formats organized by ecosystem. Each has a native protocol handler that speaks the package manager's wire protocol.

Languages & Runtimes

Containers & Infrastructure

System Packages

Configuration Management

ML / AI

Editor Extensions

Schemas

Other

Custom formats can be added via the WASM plugin system.

Security Scanning Pipeline

Every artifact upload is automatically scanned for known vulnerabilities.

flowchart LR
    UP["Artifact<br/>Upload"] --> HASH{"SHA-256<br/>Dedup"}
    HASH -->|New artifact| T["Trivy<br/>FS Scanner"]
    HASH -->|New artifact| G["Grype<br/>Dependency Scanner"]
    HASH -->|Already scanned| CACHE["Cached<br/>Results"]
    T --> SCORE["Vulnerability<br/>Score A-F"]
    G --> SCORE
    CACHE --> SCORE
    SCORE --> POL{"Policy<br/>Engine"}
    POL -->|Pass| OK["Stored"]
    POL -->|Fail| Q["Quarantined"]

• Dual scanner - Trivy for filesystem/container analysis, Grype for dependency trees
• Scoring - A through F grades based on finding severity and count
• Policies - Configurable rules that block or quarantine artifacts
• Signing - GPG/RSA signing for Debian, RPM, Alpine, and Conda packages

Container-image scanning (TRIVY_ADAPTER_URL). The base docker-compose.yml wires TRIVY_URL for the legacy trivy server (filesystem / incus rootfs scanning) only. To get first-class Trivy container-image reports, set TRIVY_ADAPTER_URL (e.g. http://scanner-adapter:8080) so the backend registers the dedicated ImageScanner against the in-repo scanner-adapter (Harbor Pluggable Scanner API). Without it, images are still covered by grype (registry mode) but no Trivy image report is produced. Uncomment the TRIVY_ADAPTER_URL line and the scanner-adapter service in docker-compose.yml to enable it.

Incus/LXC image scanning is enabled by default whenever either Trivy URL is configured. Set INCUS_SCANNER_ENABLED=false to leave that scanner out of the scanner registry when the deployment does not accept Incus images. This does not disable Trivy filesystem or container-image scanning.

The adapter pulls images back from the registry, so it must be told an address of the backend that is reachable from the adapter container — localhost is not, since the adapter itself listens on :8080 in its own network namespace (#3169). When nothing is configured the backend now advertises its own container address automatically; set TRIVY_ADAPTER_REGISTRY_URL (or the shared AK_GRYPE_REGISTRY_HOST) to override, e.g. http://backend:8080. The automatic derivation is skipped when the adapter's own URL is a loopback address, because that normally means the adapter shares this network namespace (cargo run next to a local adapter, or network_mode: host). It is not skipped correctly for an adapter container published on loopback (docker run -p 127.0.0.1:8081:8080 …scanner-adapter): there the backend reaches the adapter over loopback but the adapter cannot reach the backend that way, so set TRIVY_ADAPTER_REGISTRY_URL explicitly. The backend logs which fallback it took on every scan. Give the adapter its own trivy cache volume — reusing the trivy server's root-owned trivy_cache fails with permission denied on fanal/fanal.db because the adapter runs unprivileged (UID 1001).

Not-applicable scanners. A scanner that does not apply to an artifact's format (e.g. the filesystem/incus/openscap scanners on a Docker image) records a not_applicable result — a benign terminal state, distinct from failed. The scan-list API folds multiple not_applicable results for the same artifact into a single summary row (collapsed_not_applicable_count + collapsed_scan_types) so they read as one muted "not applicable" indication rather than N failures.

Borg Replication

Recursive peer-to-peer replication where every node is a full Artifact Keeper instance. No thin caches — each peer runs the same stack and can serve as an origin for other peers.

graph TD
    P1["Peer<br/>US-West"]
    P2["Peer<br/>EU-Central"]
    P3["Peer<br/>AP-Southeast"]
    P4["Peer<br/>US-East"]

    P1 <-->|"Chunked Transfer"| P2
    P1 <-->|"Chunked Transfer"| P4
    P2 <-->|"Chunked Transfer"| P3
    P3 <-->|"Chunked Transfer"| P4
    P1 <-->|"P2P Mesh"| P3
    P2 <-->|"P2P Mesh"| P4

• Recursive peers - Every peer is a full instance (backend, DB, storage) that can originate replication to other peers
• Swarm-based distribution - Artifacts replicate across the mesh based on demand
• Chunked transfers - Large artifacts split for reliable delivery over unstable links
• Network-aware scheduling - Bandwidth and latency profiling for optimal routing

WASM Plugin System

Extend Artifact Keeper with custom format handlers compiled to WebAssembly.

• WIT-based interface - Plugins implement a well-defined FormatHandler contract
• Wasmtime runtime - Sandboxed execution with fuel-based CPU limits and memory caps
• Hot reload - Install, enable, disable, and reload plugins without restart
• Sources - Load from Git repositories or ZIP uploads

Quick Start

Get running in 5 minutes with Docker Compose: Quickstart Guide

Documentation

• Quickstart — Get running in 5 minutes
• Installation — Docker Compose, Windows Service (beta), or build from source
• Configuration — Environment variables reference
• Package Formats — All 45+ supported formats
• Docker Deployment — Production setup guide
• mise / aqua GitHub-Releases proxy — Mirror GitHub release assets using the github, mise or aqua format with finite caching

Project Structure

artifact-keeper/
├── backend/          # Rust backend (Axum, SQLx, 6,400+ unit tests)
│   ├── src/
│   │   ├── api/      # Handlers, middleware, routes
│   │   ├── formats/  # 45+ format handler implementations
│   │   ├── services/ # Business logic (68 services)
│   │   ├── models/   # Data models (21 types)
│   │   └── storage/  # FS and S3 backends
│   └── migrations/   # 69 PostgreSQL migrations
├── edge/             # Peer replication service (Rust)
├── scripts/          # Test runners, native client tests, stress tests
└── .github/          # CI/CD workflows

Technology Choices

CI/CD Pipeline

Seven GitHub Actions workflows handle testing, publishing, and deployment.

flowchart TD
    subgraph TRIGGER["Triggers"]
        PUSH["Push / PR<br/>to main"]
        TAG["Tag v*"]
        CRON["Daily 2 AM UTC"]
        SITE_PUSH["Push to site/**"]
    end

    subgraph CI["ci.yml — Every Push/PR"]
        direction TB
        LINT["🦀 Lint Rust<br/>fmt + clippy"]
        UNIT["🧪 Unit Tests<br/>cargo test --lib"]
        INTEG["🔗 Integration Tests<br/>+ PostgreSQL<br/>(main push only)"]
        SMOKE["🔥 Smoke E2E<br/>PyPI · npm · Cargo<br/>docker-compose.test.yml"]
        AUDIT["🔒 Security Audit<br/>cargo audit"]
        CI_OK["✅ CI Complete"]

        LINT --> UNIT
        LINT --> INTEG
        UNIT --> SMOKE
        SMOKE --> CI_OK
        AUDIT --> CI_OK
    end

    subgraph DOCKER["docker-publish.yml — Push to main / tags"]
        direction TB
        BE_BUILD["Backend<br/>amd64 + arm64"]
        OS_BUILD["OpenSCAP<br/>amd64 + arm64"]
        BE_MERGE["Multi-Arch<br/>Manifest"]
        OS_MERGE["Multi-Arch<br/>Manifest"]

        BE_BUILD --> BE_MERGE
        OS_BUILD --> OS_MERGE
    end

    subgraph E2E["e2e.yml — Manual / called by release"]
        direction TB
        PKI["🔐 Setup PKI<br/>TLS + GPG"]
        NATIVE["📦 Native Client Tests<br/>10 formats"]
        STRESS["🔥 Stress Tests<br/>100 concurrent uploads"]
        FAILURE["💥 Failure Tests<br/>crash · db · storage"]

        PKI --> NATIVE
        NATIVE --> STRESS
        NATIVE --> FAILURE
    end

    subgraph RELEASE["release.yml — Tags v*"]
        direction TB
        E2E_GATE["🚦 E2E Gate<br/>all formats + stress + failure"]
        BINARIES["📦 Build Binaries<br/>linux + macOS<br/>amd64 + arm64"]
        GH_RELEASE["🚀 GitHub Release<br/>binaries + checksums"]

        E2E_GATE --> BINARIES
        BINARIES --> GH_RELEASE
    end

    subgraph NIGHTLY["scheduled-tests.yml — Daily"]
        direction TB
        NIGHTLY_E2E["🌙 Nightly Smoke E2E"]
        DEP_CHECK["🔍 Dependency Check"]
        SEC_SCAN["🔒 Security Scan"]
    end

    subgraph SITE["site.yml"]
        PAGES["📄 Build + Deploy<br/>GitHub Pages"]
    end

    subgraph AMI["ami-build.yml"]
        PACKER["🖥️ Packer Build AMI"]
    end

    PUSH --> CI
    PUSH --> DOCKER
    TAG --> RELEASE
    TAG --> DOCKER
    CRON --> NIGHTLY
    SITE_PUSH --> SITE
    GH_RELEASE -.->|"on release published"| AMI

    classDef trigger fill:#6f42c1,color:#fff,stroke:#6f42c1
    classDef ci fill:#2ea44f,color:#fff,stroke:#2ea44f
    classDef docker fill:#0969da,color:#fff,stroke:#0969da
    classDef release fill:#d97706,color:#fff,stroke:#d97706

    class PUSH,TAG,CRON,SITE_PUSH trigger
    class LINT,UNIT,INTEG,SMOKE,AUDIT,CI_OK ci
    class BE_BUILD,OS_BUILD,BE_MERGE,OS_MERGE docker
    class E2E_GATE,BINARIES,GH_RELEASE release

Sponsors

Thank you to our sponsors for supporting ongoing development of Artifact Keeper.

Backers

Ash A.

Gabriel Rodriguez

Become a sponsor to support the project and get your name listed here.

Contributing

We welcome contributions! See CONTRIBUTING.md for guidelines.

Have questions or ideas? Join the conversation in GitHub Discussions.

License

MIT License - see LICENSE for details.

Built with Rust. "JFrog" and "Artifactory" are trademarks of JFrog Ltd. Artifact Keeper is not affiliated with or endorsed by JFrog.