NORA

August 9, 2026 · View on GitHub

The artifact registry that grows with you. Starts with docker run, scales with your needs.

docker run -d -p 4000:4000 -v nora-data:/data getnora/nora:latest

Open http://localhost:4000/ui/ — your registry is ready.

NORA Dashboard

Why NORA

Zero-config — single binary, no database, no dependencies. docker run and it works.
15 registries — Docker, Maven, npm, PyPI, Cargo, Go, Raw, RubyGems, Terraform, Ansible Galaxy, NuGet, Pub (Dart/Flutter), Conan (C/C++), RPM (yum/dnf), Debian/APT.
Secure by default — OpenSSF Scorecard, signed releases, SBOM, fuzz testing, 1200+ tests.

< 30 MB binary | < 50 MB RAM idle | 3s startup | 15 registries

Supported Registries

All endpoints require authentication. Anonymous read is opt-in via anonymous_read: true.

Format	Pull (proxy/cache)	Push/Publish	Default Upstream	Notes
Docker Registry v2	✅	✅	`registry-1.docker.io`	hosted + proxy; cache on when `docker.upstreams` non-empty (Docker Hub by default)
Maven	✅	✅	`repo1.maven.org/maven2`	hosted + proxy
npm	✅	✅	`registry.npmjs.org`	hosted + proxy
Cargo	✅	✅	`crates.io` (sparse index)	hosted + proxy (sparse index)
PyPI	✅	✅	`pypi.org/simple/`	hosted + proxy
Go Modules	✅	—	`proxy.golang.org`	proxy only (modules immutable, push not in protocol)
Raw files	❌	✅	— (no upstream)	hosted only; conditional `PUT` (ETag/`If-Match` — local backend only; `If-None-Match: *` works on any backend)
RubyGems	✅	❌	`rubygems.org`	proxy only — `gem push` not implemented in NORA v1.1.0
Terraform	✅	—	`registry.terraform.io`	proxy only; client configuration notes in COMPAT.md
Ansible Galaxy	✅	❌	`galaxy.ansible.com`	proxy only — `ansible-galaxy collection publish` not implemented
NuGet	✅	❌	`api.nuget.org`	proxy only — `dotnet nuget push` not implemented
Pub (Dart/Flutter)	✅	❌	`pub.dev`	proxy only — `dart pub publish` not implemented
Conan (C/C++)	⚠️	❌	`center2.conan.io`	proxy only; Conan client compatibility tracked in COMPAT.md
RPM (yum/dnf)	⚠️	✅	— (none by default)	hosted; pull-through via `config.registries.rpm.proxies` (off by default); auto-generates `repodata/`
Debian/APT	⚠️	✅	— (none by default)	hosted; pull-through via `config.registries.deb.proxies` (off by default); flat & structured layouts; auto-generates `Packages`/`Release`/`InRelease`

Helm charts work via the Docker/OCI endpoint — helm push/pull with --plain-http or behind TLS reverse proxy.

Pull/Push legend: ✅ supported · ⚠️ partial (pull-through available but off by default, or client compatibility issue) · ❌ not implemented in NORA v1.1.0 · — not applicable (protocol has no push). Per-format details and cache strategy in COMPAT.md.

Quick Start

Docker (Recommended)

docker run -d -p 4000:4000 -v nora-data:/data getnora/nora:latest

Binary

# x86_64
curl -fsSL https://github.com/getnora-io/nora/releases/latest/download/nora-linux-amd64 -o nora

# ARM64 (Raspberry Pi, Graviton, Apple Silicon VMs)
curl -fsSL https://github.com/getnora-io/nora/releases/latest/download/nora-linux-arm64 -o nora

chmod +x nora && ./nora

./nora listens on 127.0.0.1:4000. To expose it on a network, set the bind address and the public URL clients should use for download links:

NORA_HOST=0.0.0.0 NORA_PUBLIC_URL=https://registry.example.com ./nora

Kubernetes (Helm)

helm repo add nora https://getnora-io.github.io/helm-charts
helm install nora nora/nora

From Source

cargo install nora-registry
nora

Usage

# Docker
docker tag myapp:latest localhost:4000/myapp:latest
docker push localhost:4000/myapp:latest

# npm
npm config set registry http://localhost:4000/npm/
npm publish

# Go
GOPROXY=http://localhost:4000/go go get golang.org/x/text@latest

See full documentation for all registries.

Features

Web UI — dashboard with search, browse, i18n (EN/RU)
Proxy & Cache — transparent proxy to upstream registries with local cache
Curation — blocklist, allowlist, namespace isolation, integrity verification, min-release-age filter, digest quarantine
Token RBAC — read/write/admin roles, expiry tracking, deferred last_used flush
Mirror CLI — offline sync for air-gapped environments (nora mirror)
Backup & Restore — nora backup / nora restore
S3 Storage — AWS S3, Ceph RGW, any S3-compatible backend
Prometheus Metrics — /metrics endpoint, Grafana dashboard
Rate Limiting — configurable per-endpoint rate limits

Configuration

NORA works out of the box. For advanced setup — auth, S3, retention, curation — see getnora.dev/configuration.

# Auth
docker run -d -p 4000:4000 \
  -v nora-data:/data \
  -v ./users.htpasswd:/data/users.htpasswd \
  -e NORA_AUTH_ENABLED=true \
  getnora/nora:latest

# Curation — block packages younger than 7 days
docker run -d -p 4000:4000 \
  -v nora-data:/data \
  -e NORA_CURATION_MODE=enforce \
  -e NORA_CURATION_MIN_RELEASE_AGE=7d \
  -e NORA_CURATION_ALLOWLIST_PATH=/data/allowlist.json \
  getnora/nora:latest

Performance

Metric	NORA	Nexus	JFrog
Startup	< 3s	30-60s	30-60s
Memory	< 50 MB idle	2-4 GB	2-4 GB
Binary	< 30 MB	600+ MB	1+ GB

Roadmap

~~Mirror CLI~~ ✅ v0.4.0
~~Garbage Collection & Retention~~ ✅ v0.6.0
~~Helm Chart~~ ✅ v0.6.1
~~Signed releases & SBOM~~ ✅ v0.6.4
~~Curation layer & 13 registry formats~~ ✅ v0.7.0
~~Min Release Age~~ ✅ v0.7.1
~~Hash Pin Store, auth rate limiting, Cache-Control~~ ✅ v0.8.0
~~Outbound proxy, structured audit log~~ ✅ v0.8.3
~~Circuit breaker, OIDC, hot reload, arm64, streaming uploads~~ ✅ v0.9.0
~~NuGet V3 stabilization, Cargo ETag, 1049 tests~~ ✅ v0.9.1
~~Prometheus metrics, Ansible Galaxy v3, security fixes, 1086 tests~~ ✅ v0.9.2
~~Security hardening, null byte protection, config refactor, 1204 tests~~ ✅ v0.9.3
~~Multi-upstream PyPI, conditional-request revalidation, single-flight coalescing, per-registry metrics~~ ✅ v0.9.4
~~Digest quarantine across all registries, trusted upstream dates, token access-control hardening~~ ✅ v0.9.5
Image Signing Policy — cosign verification on upstream pulls
Semver contract — stable API, configuration format, and storage layout