https://github.com/getnora-io/nora
Lightweight multi-format artifact registry. 13 formats: Docker, Maven, npm, PyPI, Cargo, Go, RubyGems, Terraform, NuGet, and more. Single binary, zero dependencies, <100MB RAM.
https://github.com/getnora-io/nora
air-gapped artifact-registry artifactory-alternative cargo-registry conan curation docker-registry maven-repository nexus-alternative npm-registry nuget oci-registry pypi-registry registry-proxy rubygems rust self-hosted single-binary supply-chain-security terraform-registry
Last synced: about 4 hours ago
JSON representation
Lightweight multi-format artifact registry. 13 formats: Docker, Maven, npm, PyPI, Cargo, Go, RubyGems, Terraform, NuGet, and more. Single binary, zero dependencies, <100MB RAM.
- Host: GitHub
- URL: https://github.com/getnora-io/nora
- Owner: getnora-io
- License: mit
- Created: 2026-01-25T16:13:37.000Z (3 months ago)
- Default Branch: main
- Last Pushed: 2026-04-27T10:50:58.000Z (about 18 hours ago)
- Last Synced: 2026-04-27T11:18:55.044Z (about 18 hours ago)
- Topics: air-gapped, artifact-registry, artifactory-alternative, cargo-registry, conan, curation, docker-registry, maven-repository, nexus-alternative, npm-registry, nuget, oci-registry, pypi-registry, registry-proxy, rubygems, rust, self-hosted, single-binary, supply-chain-security, terraform-registry
- Language: Rust
- Homepage: https://getnora.dev
- Size: 3.6 MB
- Stars: 131
- Watchers: 4
- Forks: 7
- Open Issues: 7
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Codeowners: .github/CODEOWNERS
- Security: SECURITY.md
Awesome Lists containing this project
- awesome-rust - getnora-io/nora - A lightweight, single-binary artifact registry supporting Docker, Maven, npm, PyPI, Cargo, Go, and raw formats. Upstream proxy with caching and air-gap mode. (Registries / Web programming)
- fucking-awesome-docker - NORA - Lightweight multi-protocol artifact registry supporting Docker, Maven, npm, Cargo and PyPI in a single 32MB binary. Pull-through cache, Web UI, Prometheus metrics, RBAC auth. (Docker Images / Registry)
- awesome-docker - NORA - Lightweight multi-protocol artifact registry supporting Docker, Maven, npm, Cargo and PyPI in a single 32MB binary. Pull-through cache, Web UI, Prometheus metrics, RBAC auth. (Docker Images / Registry)
- awesome-rust-with-stars - getnora-io/nora - binary artifact registry supporting Docker, Maven, npm, PyPI, Cargo, Go, and raw formats. Upstream proxy with caching and air-gap mode. | 2026-04-19 | (Registries / Web programming)
README
# NORA
**The artifact registry that grows with you.** Starts with `docker run`, scales to enterprise.
```bash
docker run -d -p 4000:4000 -v nora-data:/data ghcr.io/getnora-io/nora:latest
```
Open [http://localhost:4000/ui/](http://localhost:4000/ui/) — your registry is ready.
## Why NORA
- **Zero-config** — single binary, no database, no dependencies. `docker run` and it works.
- **13 registries** — Docker, Maven, npm, PyPI, Cargo, Go, Raw, RubyGems, Terraform, Ansible Galaxy, NuGet, Pub (Dart/Flutter), Conan (C/C++).
- **Secure by default** — [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/getnora-io/nora), signed releases, SBOM, fuzz testing, 850 tests.
[](https://github.com/getnora-io/nora/releases)
[](LICENSE)
[](https://artifacthub.io/packages/helm/nora/nora)
**< 25 MB** binary | **< 100 MB** RAM | **3s** startup | **13** registries
## Supported Registries
| Registry | Mount Point | Upstream Proxy | Auth |
|----------|------------|----------------|------|
| Docker Registry v2 | `/v2/` | Docker Hub, GHCR, any OCI, Helm OCI | ✓ |
| Maven | `/maven2/` | Maven Central, custom | ✓ |
| npm | `/npm/` | npmjs.org, custom | ✓ |
| Cargo | `/cargo/` | crates.io | ✓ |
| PyPI | `/simple/` | pypi.org, custom | ✓ |
| Go Modules | `/go/` | proxy.golang.org, custom | ✓ |
| Raw files | `/raw/` | — | ✓ |
| RubyGems | `/gems/` | rubygems.org | ✓ |
| Terraform | `/terraform/` | registry.terraform.io | ✓ |
| Ansible Galaxy | `/ansible/` | galaxy.ansible.com | ✓ |
| NuGet | `/nuget/` | api.nuget.org | ✓ |
| Pub (Dart/Flutter) | `/pub/` | pub.dev | ✓ |
| Conan (C/C++) | `/conan/` | ConanCenter | ✓ |
> **Helm charts** work via the Docker/OCI endpoint — `helm push`/`pull` with `--plain-http` or behind TLS reverse proxy.
## Quick Start
### Docker (Recommended)
```bash
docker run -d -p 4000:4000 -v nora-data:/data ghcr.io/getnora-io/nora:latest
```
### Binary
```bash
curl -fsSL https://github.com/getnora-io/nora/releases/latest/download/nora-linux-amd64 -o nora
chmod +x nora && ./nora
```
### Kubernetes (Helm)
```bash
helm repo add nora https://getnora-io.github.io/helm-charts
helm install nora nora/nora
```
### From Source
```bash
cargo install nora-registry
nora
```
## Usage
```bash
# Docker
docker tag myapp:latest localhost:4000/myapp:latest
docker push localhost:4000/myapp:latest
# npm
npm config set registry http://localhost:4000/npm/
npm publish
# Go
GOPROXY=http://localhost:4000/go go get golang.org/x/text@latest
```
See [full documentation](https://getnora.dev) for all registries.
## Features
- **Web UI** — dashboard with search, browse, i18n (EN/RU)
- **Proxy & Cache** — transparent proxy to upstream registries with local cache
- **Curation** — blocklist, allowlist, namespace isolation, integrity verification, min-release-age filter
- **Token RBAC** — read/write/admin roles, expiry tracking, deferred last_used flush
- **Mirror CLI** — offline sync for air-gapped environments (`nora mirror`)
- **Backup & Restore** — `nora backup` / `nora restore`
- **S3 Storage** — MinIO, AWS S3, any S3-compatible backend
- **Prometheus Metrics** — `/metrics` endpoint
- **Rate Limiting** — configurable per-endpoint rate limits
## Configuration
NORA works out of the box. For advanced setup — auth, S3, retention, curation — see [getnora.dev/configuration](https://getnora.dev/configuration/settings/).
```bash
# Auth
docker run -d -p 4000:4000 \
-v nora-data:/data \
-v ./users.htpasswd:/data/users.htpasswd \
-e NORA_AUTH_ENABLED=true \
ghcr.io/getnora-io/nora:latest
```
```bash
# Curation — block packages younger than 7 days
docker run -d -p 4000:4000 \
-v nora-data:/data \
-e NORA_CURATION_MODE=enforce \
-e NORA_CURATION_MIN_RELEASE_AGE=7d \
-e NORA_CURATION_ALLOWLIST_PATH=/data/allowlist.json \
ghcr.io/getnora-io/nora:latest
```
## Performance
| Metric | NORA | Nexus | JFrog |
|--------|------|-------|-------|
| Startup | < 3s | 30-60s | 30-60s |
| Memory | < 100 MB | 2-4 GB | 2-4 GB |
| Binary | < 25 MB | 600+ MB | 1+ GB |
## Roadmap
- ~~Mirror CLI~~ ✅ v0.4.0
- ~~Garbage Collection & Retention~~ ✅ v0.6.0
- ~~Helm Chart~~ ✅ v0.6.1
- ~~Signed releases & SBOM~~ ✅ v0.6.4
- ~~Curation layer~~ ✅ v0.7.0
- ~~13 registry formats~~ ✅ v0.7.0
- ~~Min Release Age~~ ✅ v0.7.1
- **OIDC / Workload Identity** — zero-secret auth for GitHub Actions, GitLab CI
- **Image Signing Policy** — cosign verification on upstream pulls
See [CHANGELOG.md](CHANGELOG.md) for release history.
## Security & Trust
[](https://scorecard.dev/viewer/?uri=github.com/getnora-io/nora)
[](https://www.bestpractices.dev/projects/12207)
[](https://github.com/getnora-io/nora/actions/workflows/ci.yml)
[](https://github.com/getnora-io/nora/actions)
See [SECURITY.md](SECURITY.md) for vulnerability reporting.
## Documentation
Full documentation: **https://getnora.dev**
## Author
Created and maintained by [Pavel Volkov](https://github.com/devitway)
[](https://getnora.dev)
[](https://t.me/getnora)
[](https://github.com/getnora-io/nora/stargazers)
## Contributing
NORA welcomes contributions! See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.
## License
MIT License — see [LICENSE](LICENSE)
Copyright (c) 2026 The NORA Authors