NORA
NORA is an open-source artifact registry for storing and serving packages across software ecosystems.
What NORA is
NORA is an open-source artifact registry for storing and serving packages across software ecosystems. It supports 13 registry formats, including Docker, Maven, npm, PyPI, Cargo, Go, and Raw. NORA can act as a proxy for upstream registries and cache artifacts locally. Its curation controls include allowlists, blocklists, CVE blocking, and integrity verification; modes range from off and audit to enforce, which returns a 403 response for matching requests. The software runs as a single Rust-built binary, with documentation describing no database or Java dependency, startup in about three seconds, and a binary under 23 MB. Docker and a Kubernetes Helm chart are documented deployment options. Storage can use AWS S3, Ceph RGW, and other S3-compatible backends, while a mirror CLI supports offline synchronization for air-gapped environments. Authentication can be enabled with an htpasswd file or the NORA_AUTH_ENABLED=true setting. NORA is self-hosted, MIT-licensed, and listed as free.
Good
- Supports 13 registry formats.
- Proxies upstream registries and caches artifacts.
- Curation includes CVE blocking and integrity checks.
- Mirror CLI supports air-gapped synchronization.
- Listed at no cost.
Watch out
- Self-hosted deployment is required.
- Enforce mode rejects matches with a 403 response.
Who it suits
NORA suits teams that need a self-hosted registry for packages from several ecosystems, with proxy caching and curation controls. Its mirror CLI may also suit air-gapped environments.
Verdict
NORA brings package storage, upstream caching, and curation controls into a self-hosted registry. Its listed plan costs nothing, and the software is MIT-licensed.
Plans and prices
From NORA's own pricing page, checked 9 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| NORA | Free | MIT licensed · self-hosted artifact registry |
The facts
Each one read from NORA's own pages, with the date it was checked.
What it does
- Authentication
- The quick start shows enabling authentication with an htpasswd file, and says authentication can be enabled with NORA_AUTH_ENABLED=true.checked 9 Oct 2026
- Client integrations
- The quick start demonstrates using Docker, npm, Go modules, and Helm OCI with a NORA registry.checked 9 Oct 2026
- Curation
- Its curation layer supports blocklists, allowlists, CVE blocking, and integrity verification.checked 9 Oct 2026
- Curation integration
- The maker documents Dozor as a companion tool that creates OSV advisory blocklists for NORA to enforce.checked 9 Oct 2026
- Curation modes
- Curation can be set to off, audit, or enforce; enforce mode blocks matching requests with a 403 response.checked 9 Oct 2026
- Deployment
- The maker documents running NORA with Docker and provides a Kubernetes Helm chart.checked 9 Oct 2026
- License
- The maker describes NORA as open source under the MIT License and free forever.checked 9 Oct 2026
- Maintainer
- The repository says NORA was created and is maintained by Pavel Volkov.checked 9 Oct 2026
- Product
- NORA (No-nonsense Open Registry for Artifacts) is an open-source, multi-protocol artifact registry built with Rust.checked 9 Oct 2026
- Proxy and cache
- NORA can transparently proxy upstream registries and cache artifacts locally.checked 9 Oct 2026
- Registry formats
- The documentation lists support for 13 formats, including Docker, Maven, npm, PyPI, Cargo, Go, and Raw.checked 9 Oct 2026
- Startup and footprint
- The documentation describes a single binary with no database or Java dependency, a startup time of about three seconds, and a binary under 23 MB.checked 9 Oct 2026
- Storage integration
- The maker lists AWS S3, Ceph RGW, and other S3-compatible backends for storage.checked 9 Oct 2026
Where it runs
- Support for air-gapped use
- NORA includes a mirror CLI for offline synchronization in air-gapped environments.checked 9 Oct 2026
Alternatives to NORA
- 1
Azure Test Plans
Free planWebAPIExtensionLinux8.1From $6 a month - 2
Nexspence
Free planOpen sourceWebAPILinuxmacOS8.1From $25 a month - 3
Oracle WebCenter Content
AndroidiOSWebAPI7.7$3,450 one-time - 4
Packagecloud
Free planWebAPILinuxmacOS7.7From $89 a month - 5
Sonatype Nexus Repository
Free planWebAPILinuxmacOS7.5From $1,950 a year - 6
Inedo ProGet
Free planWebAPILinuxSelf-hosted7.4From $2,395 a year