Artifact Keeper serves as a self-hosted universal software artifact repository that consolidates container images, application libraries, and infrastructure bundles under a unified management control plane. Software development teams can publish and resolve dependencies using their existing build tools, including Docker, Helm, npm, PyPI, Maven, Cargo, NuGet, and Terraform without installing proprietary client plugins. Remote repositories act as transparent pull-through caching proxies for public upstreams like Docker Hub and PyPI, accelerating internal CI/CD build speeds while insulating production pipelines from external registry outages. Virtual repositories combine multiple local, remote, and third-party endpoints into single URLs, resolving packages across prioritized internal teams and public registries automatically. Automated security scanners evaluate incoming packages for Common Vulnerabilities and Exposures using Trivy and Grype engines, assigning letter grades and enforcing quarantine policies to block vulnerable binaries before production release. Administrators can sign package metadata with cryptographic GPG keys, configure peer mesh replication across geographic regions, and manage team permissions using OpenID Connect, SAML, and granular access tokens. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Public registries rate-limit your CI, log every pull, and pick the worst moment to go down; Nora replaces that dependency with a self-hosted artifact registry that hosts and caches seventeen package formats behind a single address. Point Docker, Maven, npm, pip, Cargo, and eleven other clients at one endpoint, and Nora serves your private artifacts while transparently caching upstream packages fetched from Docker Hub, Maven Central, npmjs, and crates.io. Each base image or library downloads once and is then served locally, so builds get faster, stop tripping rate limits, and survive upstream outages. Curation rules decide what is allowed to reach your builds: allowlists and blocklists filter packages by name, minimum release-age rules hold back freshly published versions, and new digests can wait in quarantine until approved. Anything you publish keeps its name: a hosted package is never silently replaced by an upstream package sharing it. Pipelines publish without stored secrets through OIDC identity from GitHub Actions and GitLab CI, and API tokens with read, write, and admin roles cover the rest. A web dashboard shows downloads, cache hit rates, storage usage, and recent activity for every registry, and audit logs plus Prometheus metrics feed your monitoring. For disconnected networks, a mirror command prefetches whatever your lockfiles name, an import tool migrates Artifactory or Nexus repositories, and backup and restore keep a spare copy. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.