Your package managers \u2014 pip, npm, docker, cargo, helm, go, all of them \u2014 talk directly to it using their native protocols. Security scanning with Trivy, Grype, and OpenSCAP is built in, with a policy engine that can quarantine bad artifacts before they hit your builds. And if you need a format it doesn't support yet, there's a WASM plugin system so you can add your own without forking the backend.
Why I built it:
Part of what pulled me into computers in the first place was open source. I grew up poor in New Orleans, and the only hardware I had access to in the early 2000s were some Compaq Pentium IIs my dad brought home after his work was tossing them out. I put Linux on them, and it ran circles around Windows 2000 and Millennium on that low-end hardware. That experience taught me that the best software is software that's open for everyone to see, use, and that actually runs well on whatever you've got.
Fast forward to today, and I see the same pattern everywhere: GitLab, JFrog, Harbor, and others ship a limited "community" edition and then hide the features teams actually need behind some paywall. I get it \u2014 paychecks have to come from somewhere. But I wanted to prove that a fully-featured artifact registry could exist as genuinely open-source software. Every feature. No exceptions.
The specific features came from real pain points. Artifactory's search is painfully slow \u2014 that's why I integrated Meilisearch. Security scanning that doesn't require a separate enterprise license was another big one. And I wanted replication that didn't need a central coordinator \u2014 so I built a peer mesh where any node can replicate to any other node. I haven't deployed this at work yet \u2014 right now I'm running it at home for my personal projects \u2014 but I'd love to see it tested at scale, and that's a big part of why I'm sharing it here.
The AI story (I'm going to be honest about this):
I built this in about three weeks using Claude Code. I know a lot of you will say this is probably vibe coding garbage \u2014 but if that's the case, it's an impressive pile of vibe coding garbage. Go look at the codebase. The backend is ~80% Rust with 429 unit tests, 33 PostgreSQL migrations, a layered architecture, and a full CI/CD pipeline with E2E tests, stress testing, and failure injection.
AI didn't make the design decisions for me. I still had to design the WASM plugin system, figure out how the scanning engines complement each other, and architect the mesh replication. Years of domain knowledge drove the design \u2014 AI just let me build it way faster. I'm floored at what these tools make possible for a tinkerer and security nerd like me.
Tech stack: Rust on Axum, PostgreSQL 16, Meilisearch, Trivy + Grype + OpenSCAP, Wasmtime WASM plugins (hot-reloadable), mesh replication with chunked transfers. Frontend is Next.js 15 plus native Swift (iOS/macOS) and Kotlin (Android) apps. OpenAPI 3.1 spec with auto-generated TypeScript and Rust SDKs.
Try it:
git clone https://github.com/artifact-keeper/artifact-keeper.git\n cd artifact-keeper\n docker compose up -d\nLive demo: https://demo.artifactkeeper.com\nDocs: https://artifactkeeper.com/docs/
I'd love any feedback \u2014 what you think of the approach, what you'd want to see, what you hate about Artifactory or Nexus that you wish someone would just fix. It doesn't have to be a PR. Open an issue, start a discussion, or just tell me here.
https://github.com/artifact-keeper"},"title":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["artifactory"],"value":"Show HN: Artifact Keeper \u2013 Open-Source Artifactory/Nexus Alternative in Rust"},"url":{"matchLevel":"none","matchedWords":[],"value":"https://github.com/artifact-keeper"}},"_tags":["story","author_bsgeraci","story_46909037","show_hn"],"author":"bsgeraci","children":[46909867,46909898,46910129,46910237,46910433,46910503,46910688,46910948,46911160,46911533,46911892,46911929,46912141,46912233,46912699,46913461,46914037,46914046,46915730,46916733,46917136,46917265,46917499,46920860,46923600,46945846],"created_at":"2026-02-06T04:12:59Z","created_at_i":1770351179,"num_comments":67,"objectID":"46909037","points":166,"story_id":46909037,"story_text":"I'm a software engineer who keeps getting pulled into DevOps no matter how hard I try to escape it. I recently moved into a Lead DevOps Engineer role writing tooling to automate a lot of the pain away. On my own time outside of work, I built Artifact Keeper \u2014 a self-hosted artifact registry that supports 45+ package formats. Security scanning, SSO, replication, WASM plugins \u2014 it's all in the MIT-licensed release. No enterprise tier. No feature gates. No surprise invoices.
Your package managers \u2014 pip, npm, docker, cargo, helm, go, all of them \u2014 talk directly to it using their native protocols. Security scanning with Trivy, Grype, and OpenSCAP is built in, with a policy engine that can quarantine bad artifacts before they hit your builds. And if you need a format it doesn't support yet, there's a WASM plugin system so you can add your own without forking the backend.
Why I built it:
Part of what pulled me into computers in the first place was open source. I grew up poor in New Orleans, and the only hardware I had access to in the early 2000s were some Compaq Pentium IIs my dad brought home after his work was tossing them out. I put Linux on them, and it ran circles around Windows 2000 and Millennium on that low-end hardware. That experience taught me that the best software is software that's open for everyone to see, use, and that actually runs well on whatever you've got.
Fast forward to today, and I see the same pattern everywhere: GitLab, JFrog, Harbor, and others ship a limited "community" edition and then hide the features teams actually need behind some paywall. I get it \u2014 paychecks have to come from somewhere. But I wanted to prove that a fully-featured artifact registry could exist as genuinely open-source software. Every feature. No exceptions.
The specific features came from real pain points. Artifactory's search is painfully slow \u2014 that's why I integrated Meilisearch. Security scanning that doesn't require a separate enterprise license was another big one. And I wanted replication that didn't need a central coordinator \u2014 so I built a peer mesh where any node can replicate to any other node. I haven't deployed this at work yet \u2014 right now I'm running it at home for my personal projects \u2014 but I'd love to see it tested at scale, and that's a big part of why I'm sharing it here.
The AI story (I'm going to be honest about this):
I built this in about three weeks using Claude Code. I know a lot of you will say this is probably vibe coding garbage \u2014 but if that's the case, it's an impressive pile of vibe coding garbage. Go look at the codebase. The backend is ~80% Rust with 429 unit tests, 33 PostgreSQL migrations, a layered architecture, and a full CI/CD pipeline with E2E tests, stress testing, and failure injection.
AI didn't make the design decisions for me. I still had to design the WASM plugin system, figure out how the scanning engines complement each other, and architect the mesh replication. Years of domain knowledge drove the design \u2014 AI just let me build it way faster. I'm floored at what these tools make possible for a tinkerer and security nerd like me.
Tech stack: Rust on Axum, PostgreSQL 16, Meilisearch, Trivy + Grype + OpenSCAP, Wasmtime WASM plugins (hot-reloadable), mesh replication with chunked transfers. Frontend is Next.js 15 plus native Swift (iOS/macOS) and Kotlin (Android) apps. OpenAPI 3.1 spec with auto-generated TypeScript and Rust SDKs.
Try it:
git clone https://github.com/artifact-keeper/artifact-keeper.git\n cd artifact-keeper\n docker compose up -d\nLive demo: https://demo.artifactkeeper.com\nDocs: https://artifactkeeper.com/docs/
I'd love any feedback \u2014 what you think of the approach, what you'd want to see, what you hate about Artifactory or Nexus that you wish someone would just fix. It doesn't have to be a PR. Open an issue, start a discussion, or just tell me here.
https://github.com/artifact-keeper","title":"Show HN: Artifact Keeper \u2013 Open-Source Artifactory/Nexus Alternative in Rust","updated_at":"2026-06-02T18:38:54Z","url":"https://github.com/artifact-keeper"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"nuricanozturk"},"story_text":{"matchLevel":"none","matchedWords":[],"value":"After running Repsy as a SaaS platform for a long time, we\u2019ve decided to make it fully open-source under the Apache 2.0 License.
Many teams we worked with needed full control over their package infrastructure \u2014 for security, compliance, and to avoid vendor lock-in. This shift is largely driven by those use cases.
Repsy is a lightweight, self-hosted package repository designed as an alternative to heavier enterprise solutions.
Key features:\nNative support for Docker, Maven, npm, and PyPI\nH2 for quick setup, PostgreSQL for production\nBuilt-in deploy tokens for CI/CD\nBuilt with JDK 25 (Spring Boot 4) and Angular 21
Repo: https://github.com/repsyio/repsy\nDocs: https://docs.repsy.io"},"title":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["artifactory"],"value":"Repsy \u2013 A lightweight, open-source alternative to Nexus/Artifactory"}},"_tags":["story","author_nuricanozturk","story_47541402","ask_hn"],"author":"nuricanozturk","children":[47569953],"created_at":"2026-03-27T11:29:56Z","created_at_i":1774610996,"num_comments":0,"objectID":"47541402","points":8,"story_id":47541402,"story_text":"After running Repsy as a SaaS platform for a long time, we\u2019ve decided to make it fully open-source under the Apache 2.0 License.
Many teams we worked with needed full control over their package infrastructure \u2014 for security, compliance, and to avoid vendor lock-in. This shift is largely driven by those use cases.
Repsy is a lightweight, self-hosted package repository designed as an alternative to heavier enterprise solutions.
Key features:\nNative support for Docker, Maven, npm, and PyPI\nH2 for quick setup, PostgreSQL for production\nBuilt-in deploy tokens for CI/CD\nBuilt with JDK 25 (Spring Boot 4) and Angular 21
Repo: https://github.com/repsyio/repsy\nDocs: https://docs.repsy.io","title":"Repsy \u2013 A lightweight, open-source alternative to Nexus/Artifactory","updated_at":"2026-04-02T13:42:02Z"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"ivom2gi"},"story_text":{"matchLevel":"none","matchedWords":[],"value":""},"title":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["artifactory"],"value":"Automating a complex build - Jenkins, Gradle, Artifactory and Bitbucket"},"url":{"matchLevel":"none","matchedWords":[],"value":"http://plumbr.eu/blog/automating-a-multi-platform-build"}},"_tags":["story","author_ivom2gi","story_5673374"],"author":"ivom2gi","created_at":"2013-05-08T10:06:27Z","created_at_i":1368007587,"num_comments":0,"objectID":"5673374","points":5,"story_id":5673374,"story_text":"","title":"Automating a complex build - Jenkins, Gradle, Artifactory and Bitbucket","updated_at":"2024-09-19T19:33:53Z","url":"http://plumbr.eu/blog/automating-a-multi-platform-build"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"mellosouls"},"title":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["artifactory"],"value":"Critical CVE: JFrog Artifactory Authentication Bypass"},"url":{"matchLevel":"none","matchedWords":[],"value":"https://www.cve.org/CVERecord?id=CVE-2026-82329"}},"_tags":["story","author_mellosouls","story_49502508"],"author":"mellosouls","created_at":"2026-08-30T20:37:07Z","created_at_i":1788122227,"num_comments":0,"objectID":"49502508","points":5,"story_id":49502508,"title":"Critical CVE: JFrog Artifactory Authentication Bypass","updated_at":"2026-09-01T09:26:40Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-82329"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"mbag"},"title":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["artifactory"],"value":"Show HN: Artifactory PyPi Scanner \u2013 scan and prevent package name clashes"},"url":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["artifactory"],"value":"https://github.com/pan-net-security/artifactory-pypi-scanner"}},"_tags":["story","author_mbag","story_24942058","show_hn"],"author":"mbag","created_at":"2020-10-30T13:40:15Z","created_at_i":1604065215,"num_comments":0,"objectID":"24942058","points":5,"story_id":24942058,"title":"Show HN: Artifactory PyPi Scanner \u2013 scan and prevent package name clashes","updated_at":"2024-09-20T07:16:30Z","url":"https://github.com/pan-net-security/artifactory-pypi-scanner"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"roobs"},"title":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["artifactory"],"value":"Getting access to Zendesk\u2019s gcloud and artifactory from a GitHub dotfiles repo"},"url":{"matchLevel":"none","matchedWords":[],"value":"https://blog.assetnote.io/bug-bounty/2019/04/23/getting-access-zendesk-gcp/"}},"_tags":["story","author_roobs","story_19729193"],"author":"roobs","created_at":"2019-04-23T14:53:08Z","created_at_i":1556031188,"num_comments":0,"objectID":"19729193","points":4,"story_id":19729193,"title":"Getting access to Zendesk\u2019s gcloud and artifactory from a GitHub dotfiles repo","updated_at":"2024-09-20T04:03:20Z","url":"https://blog.assetnote.io/bug-bounty/2019/04/23/getting-access-zendesk-gcp/"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"larleys"},"story_text":{"matchLevel":"none","matchedWords":[],"value":""},"title":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["artifactory"],"value":"Introducing AQL \u2013 a super efficient query language for Artifactory"},"url":{"matchLevel":"none","matchedWords":[],"value":"https://www.voxxed.com/blog/2015/05/a-quick-leap-to-aql-a-new-query-language-for-repositories/"}},"_tags":["story","author_larleys","story_9624581"],"author":"larleys","children":[9624603],"created_at":"2015-05-29T14:02:53Z","created_at_i":1432908173,"num_comments":1,"objectID":"9624581","points":3,"story_id":9624581,"story_text":"","title":"Introducing AQL \u2013 a super efficient query language for Artifactory","updated_at":"2024-09-19T21:55:53Z","url":"https://www.voxxed.com/blog/2015/05/a-quick-leap-to-aql-a-new-query-language-for-repositories/"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"prabhuomkar"},"title":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["artifactory"],"value":"Show HN: Using GitHub as Artifactory for Machine Learning Model Artifacts"},"url":{"matchLevel":"none","matchedWords":[],"value":"https://omkar.xyz/gaama/"}},"_tags":["story","author_prabhuomkar","story_32787444","show_hn"],"author":"prabhuomkar","children":[32790299],"created_at":"2022-09-10T03:22:40Z","created_at_i":1662780160,"num_comments":1,"objectID":"32787444","points":3,"story_id":32787444,"title":"Show HN: Using GitHub as Artifactory for Machine Learning Model Artifacts","updated_at":"2024-09-20T12:05:32Z","url":"https://omkar.xyz/gaama/"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"edant"},"story_text":{"matchLevel":"none","matchedWords":[],"value":""},"title":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["artifactory"],"value":"Artifactory 3.7 now supports Docker v2"},"url":{"matchLevel":"none","matchedWords":[],"value":"https://www.jfrog.com/confluence/display/RTF/Docker+Repositories"}},"_tags":["story","author_edant","story_9569115"],"author":"edant","created_at":"2015-05-19T11:02:58Z","created_at_i":1432033378,"num_comments":0,"objectID":"9569115","points":3,"story_id":9569115,"story_text":"","title":"Artifactory 3.7 now supports Docker v2","updated_at":"2024-09-19T21:51:45Z","url":"https://www.jfrog.com/confluence/display/RTF/Docker+Repositories"},{"_highlightResult":{"author":{"matchLevel":"none","matchedWords":[],"value":"edant"},"story_text":{"matchLevel":"none","matchedWords":[],"value":""},"title":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["artifactory"],"value":"Learn how Artifactory can now be used as an in-house private Docker repository"},"url":{"fullyHighlighted":false,"matchLevel":"full","matchedWords":["artifactory"],"value":"http://www.jfrog.com/video/artifactory-docker-integration/"}},"_tags":["story","author_edant","story_8579588"],"author":"edant","created_at":"2014-11-09T10:35:39Z","created_at_i":1415529339,"num_comments":0,"objectID":"8579588","points":3,"story_id":8579588,"story_text":"","title":"Learn how Artifactory can now be used as an in-house private Docker repository","updated_at":"2024-09-19T21:20:32Z","url":"http://www.jfrog.com/video/artifactory-docker-integration/"}],"hitsPerPage":10,"nbHits":873,"nbPages":88,"page":0,"params":"query=Artifactory&hitsPerPage=10&advancedSyntax=true&analyticsTags=backend","processingTimeMS":9,"processingTimingsMS":{"_request":{"roundTrip":14},"fetch":{"query":6,"total":7},"total":9},"query":"Artifactory","serverTimeMS":9}