Cloudsmith

Overview

Cloudsmith brings artifact hosting, distribution and supply-chain controls into one managed service. It is best suited to teams that need to govern packages across a software delivery pipeline, particularly those moving away from on-premises registries or distributing artifacts globally. Its main trade-off is firm: deployment is cloud-only, with no self-hosted option.

Repositories can hold multiple formats, including Docker, Python, Maven, npm, Helm and machine-learning models, as well as raw files. Cloudsmith combines that breadth with package checks and access governance, so it can serve as more than a place to park build outputs. Its delivery network spans 600 points of presence, with edge caching and regional fault tolerance.

Key features

Cloudsmith supports 33 package formats. Its Docker-compatible, OCI-compliant container registry, mixed-format repositories and upstream proxying make it a practical central point for teams handling several artifact types. Retention rules and fine-grained access control add useful governance, though the cloud-only model will rule it out for organizations that require local hosting.

Security is a core part of the proposition. Cloudsmith checks packages, containers and ML models for known vulnerabilities, malware and license violations; policies can block items that fail, and the service logs what shipped where. Continuous risk detection, built-in CVE, license and malicious-package policies, OPA/Rego policy as code, and configurable cooldown policies give teams multiple ways to shape enforcement rather than relying on a simple scan-and-alert workflow.

Access controls include teams, service accounts, OpenID Connect, SAML SSO and groups, SCIM, and API-key policies. The developer toolkit includes a CLI, REST API, OpenAPI bindings for Go, Java, Python and Ruby, webhooks, and a VS Code extension. Integrations cover AWS CodeBuild, Azure DevOps, Bitbucket Pipelines, CircleCI, GitHub Actions, GitLab CI/CD, Jenkins, Terraform Provider and Slack. The breadth should suit teams with established CI/CD environments, while the range of controls is likely more valuable to organizations with explicit supply-chain requirements than to users seeking only basic package storage.

The standalone CLI runs on Linux, macOS and Windows, and is also installable as a Python package, Homebrew package or Docker image. Cloudsmith reports ISO 27001:2022 certification, independent verification against ASVS 4.0 Level 2, and encryption in transit and at rest. A documented API baseline is 5,400 requests per hour for authenticated Core users and 50,000 requests per five minutes for Pro, Ultra and Enterprise users, a substantial distinction for integrations with heavier API traffic.

Pricing

Cloudsmith has a freemium model, a free plan for projects with a valid open-source license, and a 14-day trial. The free open-source plan costs 0.00 USD per free and includes 50 GB of artifact data, 200 GB of package delivery and a public repository. Those quotas are generous for qualifying open-source projects, but the license requirement and public-repository condition make it unsuitable as a general private-team free tier.

Pro costs 149.00 USD per month, billed monthly. It includes 5 GB of artifact data and 25 GB of package delivery, with additional data at $1.50/GB. That makes the entry paid plan a fit for teams needing a private paid service, but the included quotas are far smaller than the open-source plan's, so usage growth can change the economics. Core has custom pricing, billed monthly, and provides 500 MB of artifact data and 1 GB of package delivery; additional data is unavailable. Its small quotas make it a constrained starting point rather than a roomy low-cost option.

Ultra and Enterprise use custom pricing and custom artifact-data, package-delivery and additional-data allowances. Ultra is billed through sales and includes Priority support and a standard uptime SLA. Enterprise is also billed through sales, with Enterprise support and custom contract terms. Core and Pro have no support tier; support rises to Priority on Ultra and Enterprise on Enterprise. All plans are billed monthly or, for the sales-led plans, through the stated contact-sales arrangement. The published storage limit is 5.

Platforms

Cloudsmith is available through web, API, extension, Linux, macOS and Windows interfaces. Its deployment is cloud-only, which avoids a self-hosted registry to maintain but leaves no option for teams that must keep the service on their own infrastructure. Support channels are email and documentation.

Who it's for

Cloudsmith makes the strongest case for small teams through enterprises that need a shared artifact service and want package security, policy enforcement and access governance in the same workflow. It is particularly relevant to organizations replacing on-premises registries, tightening software supply-chain controls, adopting AI artifacts, improving developer workflows or serving packages to distributed users. A solo developer or project without a valid open-source license should look carefully at the Pro quotas and monthly price before treating the free tier as an option.

Pros and cons

• Pros: 33 formats, raw-file support and mixed-format repositories cover a broad artifact estate without requiring separate repositories by format.
• Pros: Checks, blocking policies and shipment logging connect risk detection to release governance rather than leaving teams with alerts alone.
• Pros: Fine-grained access controls, broad CI/CD integrations and a cross-platform CLI give teams several ways to fit Cloudsmith into existing workflows.
• Cons: Cloud-only deployment excludes teams that require self-hosted infrastructure.
• Cons: The free plan is limited to projects with a valid open-source license and a public repository.
• Cons: Pro's 5 GB artifact-data and 25 GB delivery allowances are limited, and overage is $1.50/GB.
• Cons: Core includes only 500 MB of artifact data and 1 GB of delivery, with additional data unavailable; Core and Pro also lack a support tier.

Alternatives

Compare artifact repository software if you want to weigh Cloudsmith against the category more broadly.

• Sonatype Nexus Repository is worth comparing if a self-hosted option matters; its Community Edition is free and includes full ecosystem support, CI/CD integration and an external PostgreSQL database option.
• Inedo ProGet suits readers considering self-hosting and a free edition with unlimited feeds for private packages and Docker, though its free edition has limited security and compliance features.
• Packagecloud is another freemium choice, with a free plan that includes 10 GB bandwidth, 2 GB storage and unlimited CI/CD minutes.
• JFrog Artifactory is an alternative with a $50.00 per month Pro plan, 25 GB base consumption and usage-based scaling.
• Buildkite is an alternative for readers comparing software tools in this space.
• Anaconda Notebooks is an alternative for readers comparing software tools in this space.
• Artifact Keeper is an alternative for readers comparing software tools in this space.
• Google Artifact Registry is an alternative for readers comparing software tools in this space.

Verdict

Choose Cloudsmith if your team wants artifact storage and global distribution alongside enforceable supply-chain checks and access governance, and is comfortable with a cloud-only service. Its format coverage and policy controls are the strongest reasons to choose it over a basic registry. Look elsewhere if self-hosting is a requirement, or if Pro's monthly price and quotas do not fit your expected volume.