NORA

Lightweight multi-protocol artifact registry supporting Docker, Maven, npm, Cargo and PyPI in a single 32MB binary. Pull-through cache, Web UI, Prometheus metrics, RBAC auth.

Package 137 stars GitHub

NORA

The artifact registry that grows with you. Starts with docker run, scales to enterprise.

docker run -d -p 4000:4000 -v nora-data:/data getnora/nora:latest

Open http://localhost:4000/ui/ — your registry is ready.

NORA Dashboard

Why NORA

Zero-config — single binary, no database, no dependencies. docker run and it works.
13 registries — Docker, Maven, npm, PyPI, Cargo, Go, Raw, RubyGems, Terraform, Ansible Galaxy, NuGet, Pub (Dart/Flutter), Conan (C/C++).
Secure by default — OpenSSF Scorecard, signed releases, SBOM, fuzz testing, 850 tests.

< 23 MB binary | < 100 MB RAM | 3s startup | 13 registries

Supported Registries

Registry	Mount Point	Upstream Proxy	Auth
Docker Registry v2	`/v2/`	Docker Hub, GHCR, any OCI, Helm OCI	✓
Maven	`/maven2/`	Maven Central, custom	✓
npm	`/npm/`	npmjs.org, custom	✓
Cargo	`/cargo/`	crates.io	✓
PyPI	`/simple/`	pypi.org, custom	✓
Go Modules	`/go/`	proxy.golang.org, custom	✓
Raw files	`/raw/`	—	✓
RubyGems	`/gems/`	rubygems.org	✓
Terraform	`/terraform/`	registry.terraform.io	✓
Ansible Galaxy	`/ansible/`	galaxy.ansible.com	✓
NuGet	`/nuget/`	api.nuget.org	✓
Pub (Dart/Flutter)	`/pub/`	pub.dev	✓
Conan (C/C++)	`/conan/`	ConanCenter	✓

Helm charts work via the Docker/OCI endpoint — helm push/pull with --plain-http or behind TLS reverse proxy.

Quick Start

Docker (Recommended)

docker run -d -p 4000:4000 -v nora-data:/data getnora/nora:latest

Binary

curl -fsSL https://github.com/getnora-io/nora/releases/latest/download/nora-linux-amd64 -o nora
chmod +x nora && ./nora

Kubernetes (Helm)

helm repo add nora https://getnora-io.github.io/helm-charts
helm install nora nora/nora

From Source

cargo install nora-registry
nora

Usage

# Docker
docker tag myapp:latest localhost:4000/myapp:latest
docker push localhost:4000/myapp:latest

# npm
npm config set registry http://localhost:4000/npm/
npm publish

# Go
GOPROXY=http://localhost:4000/go go get golang.org/x/text@latest

See full documentation for all registries.

Features

Web UI — dashboard with search, browse, i18n (EN/RU)
Proxy & Cache — transparent proxy to upstream registries with local cache
Curation — blocklist, allowlist, namespace isolation, integrity verification, min-release-age filter
Token RBAC — read/write/admin roles, expiry tracking, deferred last_used flush
Mirror CLI — offline sync for air-gapped environments (nora mirror)
Backup & Restore — nora backup / nora restore
S3 Storage — AWS S3, Ceph RGW, any S3-compatible backend
Prometheus Metrics — /metrics endpoint
Rate Limiting — configurable per-endpoint rate limits

Configuration

NORA works out of the box. For advanced setup — auth, S3, retention, curation — see getnora.dev/configuration.

# Auth
docker run -d -p 4000:4000 \
  -v nora-data:/data \
  -v ./users.htpasswd:/data/users.htpasswd \
  -e NORA_AUTH_ENABLED=true \
  getnora/nora:latest

# Curation — block packages younger than 7 days
docker run -d -p 4000:4000 \
  -v nora-data:/data \
  -e NORA_CURATION_MODE=enforce \
  -e NORA_CURATION_MIN_RELEASE_AGE=7d \
  -e NORA_CURATION_ALLOWLIST_PATH=/data/allowlist.json \
  getnora/nora:latest