NORA

One binary, seventeen package formats, no database. NORA is a self-hosted artifact registry and pull-through cache for Docker, Maven, npm, PyPI, Cargo, Go and more, with supply-chain controls built in.

docker run -d -p 4000:4000 -v nora-data:/data getnora/nora:latest

Open http://localhost:4000/ui/: the registry is ready.

Why NORA

• Small and quick to start. A static binary of about 23 MB with no database and no runtime to install; it answers in under a second and idles at about 15 MB of memory (BENCHMARKS.md).
• Seventeen formats, hosted and proxied. One registry for containers, language packages, OS packages and Hugging Face models, on local disk, S3-compatible storage or Google Cloud Storage.
• What you publish stays yours. A package, crate or image published to NORA is never replaced by an upstream package of the same name. Curation — allowlist, blocklist, minimum release age, quarantine of new versions, internal namespaces — decides what reaches your builds.
• Ready to operate. A web UI in English, Russian and Chinese, API tokens with read, write and admin roles, keyless publishing from GitHub Actions and GitLab CI with OIDC, rate limits, an audit log and Prometheus metrics.
• Works without the internet. nora mirror prefetches what your lockfiles name for air-gapped networks, nora import moves an Artifactory or Nexus repository in, and nora backup / nora restore keep a copy.

Supported formats

Format	Proxy & cache	Hosted
Docker / OCI	✅	✅
Maven	✅	✅
npm	✅	✅
PyPI	✅	✅
Cargo	✅	✅
Go modules	✅	—
Raw files	—	✅
RubyGems	✅	—
Terraform	✅	—
Ansible Galaxy	✅	—
NuGet	✅	—
Pub (Dart, Flutter)	✅	—
Conan (C, C++)	✅	—
CPAN	✅	—
RPM (yum, dnf)	opt-in	✅
Debian / APT	opt-in	✅
Hugging Face Hub	opt-in	—

Opt-in: the Hugging Face proxy (NORA_HF_ENABLED=true) and RPM/Debian pull-through ([rpm.proxies], [deb.proxies]). Default upstreams, protocol coverage and client notes for each format: COMPAT.md.

Install

• Docker: getnora/nora on Docker Hub and ghcr.io/getnora-io/nora (amd64, arm64), with RED OS and Astra Linux SE variants (<version>-redos, <version>-astra).
• Kubernetes: helm repo add nora https://getnora-io.github.io/helm-charts && helm install nora nora/nora (Helm guide).
• Binary, .deb / .rpm packages, from source: installation guide.

Upgrading: upgrade guide.

Use

# Docker
docker tag myapp:latest localhost:4000/myapp:latest
docker push localhost:4000/myapp:latest

# npm
npm config set registry http://localhost:4000/npm/

# pip
pip install --index-url http://localhost:4000/simple/ requests

Every format has its own page with client setup, publishing and proxy options: registries.

Configure

NORA reads environment variables or a config.toml. A registry that proxies upstream packages should say how they are checked:

NORA_CURATION_MODE=enforce NORA_CURATION_MIN_RELEASE_AGE=7d \
NORA_CURATION_QUARANTINE=enforce \
  docker run -d -p 4000:4000 -v nora-data:/data getnora/nora:latest

All settings: configuration reference, curation, authentication, S3 storage. Metrics and dashboards: MONITORING.md.

Security

Releases are signed with cosign and ship SBOMs (SPDX, CycloneDX) and SLSA provenance. Advisories are published on GitHub; report a vulnerability as described in SECURITY.md.

Roadmap

Next is 1.5.0: an explicit curation.mode whenever a proxy registry is enabled, and one definition of an artifact count across the dashboard, the API and the metrics. See ROADMAP.md and CHANGELOG.md.

Ecosystem

• Dozor compiles the OSV advisory feed and an inventory of your registry into a curation blocklist that NORA enforces.
• Helm chart for Kubernetes.

Community

Questions and ideas: Telegram and issues. Contributions are welcome — see CONTRIBUTING.md, CODE_OF_CONDUCT.md and GOVERNANCE.md.

License

MIT — see LICENSE. Copyright (c) 2026 The NORA Authors.