The artifact registry that grows with you. Starts with docker run, scales with your needs.

docker run -d -p 4000:4000 -v nora-data:/data getnora/nora:latest

Open http://localhost:4000/ui/ — your registry is ready.

• Zero-config — single binary, no database, no dependencies. docker run and it works.
• 13 registries — Docker, Maven, npm, PyPI, Cargo, Go, Raw, RubyGems, Terraform, Ansible Galaxy, NuGet, Pub (Dart/Flutter), Conan (C/C++).
• Secure by default — OpenSSF Scorecard, signed releases, SBOM, fuzz testing, 1200+ tests.

< 25 MB binary | < 50 MB RAM idle | 3s startup | 13 registries

Helm charts work via the Docker/OCI endpoint — helm push/pull with --plain-http or behind TLS reverse proxy.

docker run -d -p 4000:4000 -v nora-data:/data getnora/nora:latest

# x86_64
curl -fsSL https://github.com/getnora-io/nora/releases/latest/download/nora-linux-amd64 -o nora

# ARM64 (Raspberry Pi, Graviton, Apple Silicon VMs)
curl -fsSL https://github.com/getnora-io/nora/releases/latest/download/nora-linux-arm64 -o nora

chmod +x nora && ./nora

helm repo add nora https://getnora-io.github.io/helm-charts
helm install nora nora/nora

cargo install nora-registry
nora

# Docker
docker tag myapp:latest localhost:4000/myapp:latest
docker push localhost:4000/myapp:latest

# npm
npm config set registry http://localhost:4000/npm/
npm publish

# Go
GOPROXY=http://localhost:4000/go go get golang.org/x/text@latest

See full documentation for all registries.

• Web UI — dashboard with search, browse, i18n (EN/RU)
• Proxy & Cache — transparent proxy to upstream registries with local cache
• Curation — blocklist, allowlist, namespace isolation, integrity verification, min-release-age filter
• Token RBAC — read/write/admin roles, expiry tracking, deferred last_used flush
• Mirror CLI — offline sync for air-gapped environments (nora mirror)
• Backup & Restore — nora backup / nora restore
• S3 Storage — AWS S3, Ceph RGW, any S3-compatible backend
• Prometheus Metrics — /metrics endpoint, Grafana dashboard
• Rate Limiting — configurable per-endpoint rate limits

NORA works out of the box. For advanced setup — auth, S3, retention, curation — see getnora.dev/configuration.

# Auth
docker run -d -p 4000:4000 \
  -v nora-data:/data \
  -v ./users.htpasswd:/data/users.htpasswd \
  -e NORA_AUTH_ENABLED=true \
  getnora/nora:latest

# Curation — block packages younger than 7 days
docker run -d -p 4000:4000 \
  -v nora-data:/data \
  -e NORA_CURATION_MODE=enforce \
  -e NORA_CURATION_MIN_RELEASE_AGE=7d \
  -e NORA_CURATION_ALLOWLIST_PATH=/data/allowlist.json \
  getnora/nora:latest

• Mirror CLI ✅ v0.4.0
• Garbage Collection & Retention ✅ v0.6.0
• Helm Chart ✅ v0.6.1
• Signed releases & SBOM ✅ v0.6.4
• Curation layer & 13 registry formats ✅ v0.7.0
• Min Release Age ✅ v0.7.1
• Hash Pin Store, auth rate limiting, Cache-Control ✅ v0.8.0
• Outbound proxy, structured audit log ✅ v0.8.3
• Circuit breaker, OIDC, hot reload, arm64, streaming uploads ✅ v0.9.0
• NuGet V3 stabilization, Cargo ETag, 1049 tests ✅ v0.9.1
• Prometheus metrics, Ansible Galaxy v3, security fixes, 1086 tests ✅ v0.9.2
• Security hardening, null byte protection, config refactor, 1204 tests ✅ v0.9.3
• Image Signing Policy — cosign verification on upstream pulls
• Semver contract — stable API, configuration format, and storage layout

See ROADMAP.md for the full roadmap and CHANGELOG.md for release history.

See SECURITY.md for vulnerability reporting.

Full documentation: https://getnora.dev

Created and maintained by Pavel Volkov

NORA welcomes contributions! See CONTRIBUTING.md for guidelines.

MIT License — see LICENSE

Copyright (c) 2026 The NORA Authors