Skip to content

Artifact repositories for language packages

An artifact repository stores the packages that your builds produce and consume. Examples are Python wheels, Java JARs, npm tarballs and NuGet packages. Most products can also act as a proxy cache. A proxy cache stores copies of public packages from PyPI, Maven Central or npmjs.

This page compares commercial and free options. For each option, it shows the company, the free or open source edition and the traction. Container-only registries (for example Harbor, a CNCF graduated project) are out of scope.

Data as of October 2026. GitHub stars are approximate values.

Multi-format products (self-managed)

Product Company Free or open source edition Language formats Traction
Nexus Repository Sonatype (owned by Vista Equity Partners) Community Edition: free, proprietary EULA, usage limits. Nexus Repository Core: open source (EPL), source only, Maven, raw and APT only Maven, npm, PyPI, NuGet, RubyGems, Go, Cargo, Composer, Conan, Conda, R and more One of the two market leaders. Very large installed base from the old OSS edition. sonatype/nexus-public has ~2.7k stars
Artifactory JFrog (public company, NASDAQ: FROG) Artifactory OSS: open source, but only Maven, Gradle, Ivy, SBT and generic. A free cloud tier also exists All main formats (30+) Market leader. FY2025 revenue of $531.8M. About 1,300 customers above $100K ARR
ProGet Inedo ProGet Free: proprietary, commercial use allowed, unlimited users and feeds, no feed-level security NuGet, npm, PyPI, Maven, RubyGems, Conda, Debian, Helm and more Strong in the .NET and Windows world. Small compared to JFrog and Sonatype
Pulp Open source community, sponsored by Red Hat Fully open source (GPLv2) PyPI, Maven (tech preview), npm, RubyGems, RPM, Debian, Ansible Base of Red Hat Satellite and Ansible Automation Hub. pulp/pulpcore has ~600 stars
Gitea Gitea Ltd and community Fully open source (MIT). Package registry included Maven, npm, PyPI, NuGet, Cargo, Composer, Conan, Conda, Go, RubyGems, Swift and more go-gitea/gitea has ~58k stars. The registry is a secondary feature of a Git forge
Forgejo Codeberg e.V. (community fork of Gitea) Fully open source (GPLv3+) Same formats as Gitea Used by Codeberg.org. Growing in the self-hosting community

Single-format products (self-managed, open source)

Product Company License Format Traction
Reposilite Community (lead author dzikoysk) Apache 2.0 Maven (JVM) ~1.9k stars. A light alternative to Nexus for Java
devpi Community MIT PyPI ~1.2k stars. Mature, used for PyPI mirrors
pypiserver Community MIT and zlib/libpng PyPI ~2.1k stars. Minimal, no proxy cache with cache storage
Verdaccio Community MIT npm ~18k stars. The standard self-hosted npm registry
Kellnr Community Apache 2.0 or MIT Cargo (Rust) ~1.1k stars
Apache Archiva Apache Software Foundation Apache 2.0 Maven Retired. The GitHub repository is archived. Do not use it for new installations

Managed services (SaaS)

Product Company Free tier Language formats Traction
AWS CodeArtifact Amazon Web Services No free edition. Pay per GB stored and per request (small AWS Free Tier) Maven, Gradle, npm, PyPI, NuGet, Ruby, Cargo, Swift, generic Default option for teams on AWS. Packages cannot be public
Azure Artifacts Microsoft (part of Azure DevOps) 2 GiB of storage free per organization Maven, Gradle, npm, PyPI, NuGet, Cargo, Universal Packages Default option for teams on Azure DevOps
Google Artifact Registry Google Cloud Small free storage quota (0.5 GB) Maven, npm, PyPI, Go, Apt, Yum, Ruby (preview), generic Default option for teams on Google Cloud. No NuGet
GitHub Packages GitHub (Microsoft) Free for public packages. Free storage quota for private packages, by plan Maven, Gradle, npm, NuGet, RubyGems Very large user base. No PyPI support
GitLab Package Registry GitLab Inc. (public company, NASDAQ: GTLB) Included in GitLab Community Edition (MIT) and on GitLab.com Maven, Gradle, npm, PyPI, NuGet, Conan, Composer, Go, Helm, generic Large user base. You get it with every GitLab instance
Cloudsmith Cloudsmith Ltd SaaS only. Free plan for open source projects Maven, npm, PyPI, NuGet, Cargo, Go, RubyGems, Conda and more Smaller vendor. Popular with open source projects
JFrog Cloud JFrog Free cloud tier with storage and transfer limits Same as Artifactory Over half of JFrog revenue comes from cloud

Licensing changes to know

Sonatype Nexus Repository

In February 2025, Sonatype replaced Nexus Repository OSS with Community Edition (CE), starting with version 3.77.0. CE adds formats and PostgreSQL support, but it uses a proprietary EULA and has usage limits. If an instance goes over the limits, you must buy Nexus Repository Pro or reduce the usage. The open source Nexus Repository Core still exists, but Sonatype publishes no binaries. You must build it from source.

JFrog Artifactory OSS

Artifactory OSS is still an official edition, but it supports only Java build tools and generic files. In 2026, JFrog moved self-managed releases to a channel that requires a login. The future of public OSS binaries is not clear (see jfrog/charts issue #2562).

How to choose

  • If you need one free self-managed tool for all languages, start with Nexus Community Edition. Make sure that you stay under its limits.
  • If you need a fully open source multi-format tool, use Pulp, Gitea or Forgejo.
  • If you already use GitLab, GitHub, AWS, Azure or Google Cloud, use the registry that comes with the platform first.
  • If you need only one language, a single-format tool (Reposilite, devpi, Verdaccio) is the simplest option.
  • If you need enterprise features such as high availability, replication and advanced security scanning, compare Artifactory and Nexus Pro.

References