By submitting this form, you agree to our 

That’s what I want for Northern Ireland’s software sector. And we are doing it together.

Northern Ireland is a great place to live. Culturally, we are a country of innovators and builders, and it is already a great place to build software. Whether you are starting something new or want to contribute to systems and tools used all over the world, the software industry in NI is well-established.

Yes, we have our challenges as a country, just like anywhere else. But we have an exciting and emerging startup ecosystem, circling venture capital, and we are the software development headquarters for big companies like Aflac, Allstate, and Liberty Mutual. And we finally have an official LEGO store.

I left Northern Ireland two days after graduating from Queen’s University Belfast in 2002, and lived in the United States and then England for a few years. But soon the love of grey skies pulled me back home and into a job at a newly minted startup, albeit one that struggled to find its feet. 

After moving on from my first NI-based startup. I then watched Danny Moore sell Wombat Financial Technologies to the mighty New York Stock Exchange in 2008. This was a signpost of what is possible with great leadership and execution. So when Lee and I founded Cloudsmith, our goal was, and still is, to build a world-class product company headquartered in Belfast.

There are many challenges with building a business, especially in a small country with just under 2 million people. We have great universities in Ulster University and Queen’s (and not forgetting our friends at the Open University), producing a steady stream of graduates; there is a growing talent pool and lots of opportunity for innovation.

Those who have tasted success can inspire, guide, and expand the limits of what is possible.

It's pretty unusual to be more than two degrees of (Kevin Bacon) separation away from anyone from Northern Ireland here. We witnessed firsthand the power of diaspora: Northern Ireland looks out for its own, and we made connections all over the world with folks who left to seek their fortune in faraway lands. Some have been absolutely key to Cloudsmith’s success to date, and it’s always a pleasure to hear the unmistakable accent come back at you over Zoom.

We need more success stories. We need to show the workforce that share options are worth something. We need more exits. We need to create more wealth.

I’ve seen the power of being in a well-funded startup with great, founder-friendly early-stage backers (thank you, Techstart, Frontline, and MMC) that can elevate you to take on the competition.

How do we get more money into Northern Ireland companies? How do we get the light from Sauron’s Eye shining on our little country? OK, that sounds ominous, but I mean it in a good way. How can we position ourselves as a hotbed of innovation and talent, to rival Silicon Valley or Tel Aviv?

That is something we are tackling at Software NI, but we need all the help we can get. 

 is dedicated to making Northern Ireland a global leader in technology and software innovation through community, education, advocacy, and support. Everything from championing software literacy in schools to affecting governmental policies to ensure software is part of our future.

We welcome you to engage with the community at the new 

, organized by Software NI. The inaugural event will take place on Thursday, 26th March, in The Mac. It promises to be an excellent opportunity to listen to industry leaders, including Danny Moore, discuss how they scaled their businesses and created value. I’ll be there too :)

Remember, Northern Ireland is amazing, Cloudsmith is building something great, and Software NI is striving to create an ecosystem where people and software companies of all shapes and sizes can thrive.

Alan Carson

Co-founder and Chief Strategy Officer

I love Software (in) NI

Our mission at Cloudsmith is to provide development, DevOps, and platform engineering teams with an incredibly powerful, easy-to-use tool for controlling and securing software artifacts globally. We build features with the enterprise in mind–features that provide centralized management and policy enforcement across hundreds of teams and thousands of developers.

We have an ambitious vision to run the world’s software supply chain more efficiently, more securely, and more intelligently than is possible with the traditional set of tools available in our market.

To that end, we made fantastic progress in 2025 in extending the reach of Cloudsmith to organizations new to enterprise-grade artifact management platforms, as well as organizations upgrading from legacy vendors to meet their internal scalability and security requirements. Let’s review some key milestones we achieved in 2025 with our customers and partners.

A peek behind the curtain into the goings-on at Cloudsmith HQ.

 and many of our existing investors. This investment reflects the confidence our customers place in Cloudsmith to control their mission-critical software build workloads, as well as the hard work from every Cloudsmither. We’re using the funding to build an even better Cloudsmith that can cover more use cases, handle near-infinite scale, and be the fastest and most reliable solution on the market.

We added quite a few Cloudsmithers, increasing our total headcount by 92% in 2025. We’re using all that effort and brainpower to stay on top of the software supply chain security space, so we can help our customers protect their own build pipelines against emerging threats.

A couple of notable honors made their way to Cloudsmith HQ this year:

: Tech Visionary of the Year – Cloudsmith CTO Lee Skillen.

 Leaderboard 2025: Cloudsmith ranked number 59.

Ships are nothing new in Belfast, our home city which has a proud shipbuilding history. That said, at Cloudsmith, we prefer to ship code. Here are a few highlights from the new features and capabilities we launched in 2025:

: Cloudsmith extends artifact management and governance to 

 and datasets, allowing you to control and manage AI artifacts alongside the rest of your software supply chain. ML models flow through the same access controls, policies, scanning, and audit trails as packages and containers, so adopting AI doesn’t introduce new blind spots or require parallel tooling.

 Enables you to define policies as code that match how your pipelines and security rules actually work. Policies can incorporate context such as package metadata, vulnerability severity, and licenses, and enforce those criteria before promoting or using artifacts.

: Automatically checks artifacts for vulnerabilities, malware, and malicious packages on a rolling basis, generating reports hourly. When a new vulnerability is reported against a previously allowed package, EPM triggers a re-evaluation of artifacts against your standing policies and automatically takes actions, such as blocking or quarantining.

Malware scanning and malicious package detection:

 Adds malware and malicious package detection to traditional vulnerability scanning, preventing malicious packages from entering repositories or being distributed. This helps teams avoid pulling in unsafe dependencies from upstream sources and reduces the risk of compromised software spreading through CI/CD pipelines or to customers.

: Enable teams to distribute software to customers or partners in a developer-native way, using the same delivery platform and governance they rely on internally, while presenting it through a branded, customer-facing experience. Customers can restrict, audit, and revoke access without setting up parallel systems or losing visibility–so external delivery doesn’t become a security or operational exception.

: We added new upstreams for four supported formats this year (

), and increased our support for native signing to include 

: When you want to give your eyes a rest, dark mode is at the ready!

We know our customers derive business value from Cloudsmith, because they’re building more software with Cloudsmith.

Total package delivery increased 352% YoY.

The most popular artifact types were Python, npm, NuGet, rpm, Debian, and Maven, which together made up 90% of all artifact requests.

The most consumed formats by size (accounting for 90% of total gigabytes delivered) were Docker, Python, raw, npm, and NuGet.

💡Interesting fact: In total bytes, Docker image deliveries in the first 

 of December 2025 was nearly the same as that for the entire month of January 2025.

npm and Python package delivery requests increased by 400% YoY.

Plays Well With Others: Community, Events, and Integrations

The Cloudsmith platform does a lot of heavy lifting, and it does even more together with our partners. We trotted (a good portion of) the globe and scoured the corners of the internet to deliver a better artifact management experience to developers and organizations alike.

We were active in the developer community in 2025. We sponsored or attended 18 events across North America and Europe, connecting with developers and platform teams in 10 cities at KubeCon + CloudNativeCon, GitHub Universe, PlatformCon, SRECon, and Container Days.

We’re in it for the bright lights and big stages, but some of our favorite moments came from smaller, high-impact community meetups like Kubernetes Community Days in New York and Edinburgh, Cloud Native Dublin, and BSides in our hometown of Belfast.

At every stop, big or small, our goals were to learn from the community, share what we’re building, and help teams ship software with confidence.

It’s worth noting that Cloudsmithers from all over the world also gathered three times this year in our home city of Belfast for all-hands offsites to learn, share, and grow together.

We’re developers building for developers. For us, it’s important to improve the developer experience. We built integrations for developer tools this year to make it easier for users to manage and secure their development pipelines. Here are a few highlights from 2025.

: Allows users to manage experiments run on ML models and collaborate in a centralized location for machine learning test cases.

 integration for better observability and monitoring of how artifacts flow through your software supply chain.

, both public and private Chainguard registries, natively with Cloudsmith.

: Explore and inspect your artifacts from within your 

: Bringing secure artifact management to machine learning development.

From initial conversations, to migrations, to ongoing support, Cloudsmithers provide users with the service and attention they need to make artifact management “just work.” Our customer support satisfaction rose to 

Here’s some of our favorite feedback from customers:

"It's rare these days to see this level of support and engagement when dealing with SaaS support."

"I must say that the support we have received from Cloudsmith has been outstanding."

"I feel it’s important to recognise the Cloudsmith team who have been wonderful throughout the whole process...[they] were patient, fun to talk with (just real-human), knowledgeable, flexible, and truly listened to our needs."

We also published new case studies that demonstrate Cloudsmith’s value, showing how the Cloudsmith experience unfolds from the customer’s point of view.

 shifted focus from infrastructure to managing artifacts securely with Cloudsmith.

 migrated to Cloudsmith and eliminated outages entirely.

consumer and industrial electronics organization

 leveraged Cloudsmith’s Enterprise Policy Manager for better package visibility and governance.

We’re proud of what we helped customers achieve in 2025. And we’re doubling down on our R&D investments in 2026 to deliver an artifact management platform that exceeds anything on the market today.

We want Cloudsmith to be a platform that:

Takes full advantage of our massive-scale, multi-tenant architecture to deliver previously unthinkable performance and scalability to CI/CD pipelines and IDEs no matter where they’re located.

Provides practical solutions for securing the enterprise software supply chain from open source vulnerabilities and malicious packages without hindering productivity.

Works in conjunction with your DevOps stack to deliver a single source of truth for software artifacts, informed by huge public data sets and AI-powered insights.

And we’ll do it all with our ultimate customer–the software developer–foremost in our minds.

Please reach out to me at ceo@cloudsmith.com with your thoughts and suggestions as we seek to build the artifact management platform that the world truly needs. 

Glenn Weinstein

Cloudsmith 2025: By the Numbers

Across your organization, teams are rapidly adopting AI and machine learning. They’re pulling ML models and datasets from public sources like Hugging Face and wiring them into workflows that are now reaching production. For platform and security leaders, this creates a familiar challenge: artifacts are entering the software supply chain outside established governance and controls.

Unmanaged AI artifacts carry real risks. They can’t be traced back to their source, they don’t follow compliance processes, and they often bypass the review gates you rely on for code and containers. Left unchecked, they become blind spots and liabilities in your supply chain. Without action, AI artifacts become the weakest link in your supply chain security.

The answer is to manage ML models and datasets with the same level of control and oversight as every other artifact in your supply chain. By managing them through a unified platform—with shared repositories, consistent policy enforcement, and full observability—you ensure that ML workflows are governed by the same standards as the rest of your software supply chain.

The growing adoption of ML models and datasets introduces both opportunity and risk. On one hand, models accelerate delivery by enabling new capabilities at unprecedented speed. On the other hand, they introduce opaque dependencies, security blind spots, and compliance risks into the supply chain—areas where governance practices are still catching up.

Some risks begin earlier in the lifecycle, like poisoned training data or tampered weights during model creation, which can compromise a model before it ever reaches a registry. But the most immediate challenge for platform and security leaders is governance once these artifacts enter the supply chain. Teams often pull models directly from public sources like Hugging Face, bypassing review and scanning. Without versioning and provenance tracking, it’s nearly impossible to prove which model is in use, where it came from, or what depends on it. And without consistent policies, organizations struggle to demonstrate compliance when auditors or regulators come calling.

These risks can’t be left unmanaged. The question is how to bring ML artifacts under control.

ML models and datasets are artifacts, and like any artifact, they need to be versioned, audited, and controlled with the same enterprise-grade policies you’ve put in place for packages like code libraries and container images. As organizations deliver production applications powered by AI, the priority for platform and security leaders is clear: maintain visibility, integrity, and trust in the components that make up these builds.

Cloudsmith’s new ML Model registry support

A Single Source of Truth for ML Models in DevOps

Cloudsmith extends artifact management to ML models and datasets, promoting them to first-class artifacts in your supply chain. This means you can control, secure, and distribute models alongside your language libraries, containers, and other binaries, all governed by the same policies and observability already in place.

: Require approvals, license checks, and compliance gates before a model or dataset is deployed.

: Every artifact is versioned, hashed, and immutable, so tampering can be detected and blocked.

: Capture where a model or dataset came from, how it has changed, and what depends on it.

: Manage ML models (PyTorch, TensorFlow, ONNX, and more) alongside other binary artifacts in the same repositories.

: Proxy and cache models and datasets directly from the Hugging Face Hub, while continuing to use the Hugging Face SDK for training and deployment — ensuring developers keep their workflows while you enforce governance.

DevOps has always been about balancing efficiency, stability, and security. The rise of ML workflows doesn’t change that balance - it heightens the need for it. By incorporating ML models and datasets into Cloudsmith, you extend the same supply chain controls that protect your code and containers to the AI artifacts now driving production systems.

The result: faster innovation without unmanaged risk, and a single platform to govern every component that ships to production.

Learn more about Cloudsmith's ML Model Registry here.

How to securely source your LLM models from Hugging Face

Alison Sickelka

VP of Product

Extending supply chain governance to AI and ML artifacts

The enterprise artifact management market - which has belonged for a while to JFrog and Sonatype - is now 

Cloudsmith was built on the core principle that 

. So does simplicity in design and workflow. Partnerships matter, too. We’ve built a comprehensive platform that controls and secures every artifact as it’s built, scanned, signed, stored, and shipped across the software supply chain. We’ve tailored our product to the specific needs of large organizations, which support hundreds of software development teams, rely on a huge range of languages and formats, operate at massive scale, and need to ensure the provenance and integrity of artifacts entering their supply chain.

Our work is paying off. Today our product helps Fortune 500 and Global 2000 corporations, as well as independent software companies, build and distribute their software more securely and efficiently. Many of these customers migrated to Cloudsmith from the two primary legacy solutions on the market - JFrog’s Artifactory, and Sonatype’s Nexus. These customers came to us because they ran into challenges scaling to ever-increasing DevSecOps demands. They asked for a fully managed platform that just works, so they can focus on building software, not infrastructure, CDNs, or clusters. And they recognized Cloudsmith as a fresh, modern, developer-friendly, API-first experience. Cloudsmith is infrastructure you don’t have to think about.

A successful startup transitions into scale-up mode when it solves customer problems in new and innovative ways, and starts to win real market share. Cloudsmith has arrived here. We 

closed our Series B with TCV and Insight Partners

 earlier this year to fund our growth. We’re seeing incumbents take notice. We’re seeing analyst firms like Gartner and Forrester recognizing Cloudsmith as a new and legitimate candidate for enterprises with complex needs. JFrog CFO Ed Grabscheid confirmed our growing market share when he 

told investors at a Bank of America conference

 on June 5 that they see two main competitors: Sonatype and a “

very, very small startup that is a cloud-native tool… not even worth mentioning the name,

” I’m pretty sure he was talking about Cloudsmith.

We agree that large organizations are looking at three main options - JFrog, Sonatype, and Cloudsmith - for comprehensive artifact management. The artifact offerings from hyperscalers like Azure, AWS, and Google, as well as SDLC leaders like GitHub and GitLab, are limited to a handful of formats and use cases. They’re okay for small teams, but they’re not intended to scale across broad engineering organizations. We hear every day from JFrog and Sonatype customers who are curious if Cloudsmith is a viable alternative to their legacy vendor, and from platform engineering teams who recognize the benefits of a common internal set of universal artifact repositories.

I suppose it’s in the spirit of this head-to-head competition that 

 of our advanced security offerings. They didn’t reach out to us in advance, and appear to have based their findings on their use of a Cloudsmith self-service trial account. We would have been happy to help them make a more well-informed comparison! We think their conclusions are misleading or highly confused, and they got a lot flat-out wrong. Our solutions engineers love working with prospective Cloudsmith customers to showcase the actual capabilities of Cloudsmith, in a way that’s relevant to their company’s processes, scale, and needs.

There is one point in JFrog’s analysis of Cloudsmith that I found telling. They seem to fault our approach to artifact security scanning for relying on third-party industry vulnerability data. This outlook seems to align with JFrog’s general position on partnerships (that they’re bad for business). At that same Bank of America conference, JFrog’s CFO said that when it comes to security scanning, “

” cannot operate without having a proxy to JFrog for access to the binary artifacts, which is true. 

you could cut the oxygen off to these point solutions. We choose not to do that, but most customers see advantage to two things: consolidation, and to secure the most critical asset, which is your binary.

We just have a different philosophy. We don’t think customers want their artifact management vendor to be their only source of vulnerability data and security scanning. In other words, not all JFrog Artifactory customers want to depend solely on JFrog Xray. We know that for sure, because they’ve told us. So we’re working hard to ensure Cloudsmith works well with commercial and open source security tools like ClamAV, Trivy, and Grype, as well as data sources like EPSS and CVSS, and we regularly incorporate their data into the metadata that’s available inside Cloudsmith repositories and exposed to our Enterprise Policy Manager (EPM). In this way, Cloudsmith is the control plane and the data plane for the entire software supply chain, but we don’t think we should be the sole provider of security data. We will not - to quote JFrog - “cut the oxygen off” from our partners in the ecosystem. We feel similarly about CI/CD, runtime scanning, observability, and hardened images; solving software supply chain security works best as a team sport.

If you want to see why so many companies are turning to Cloudsmith, 

 about what a modern, scalable, cloud-native artifact platform could look like for your organization.

The Artifact Management Market Is Up For Grabs

Exploring AI and the future of the software supply chain

AI assistants will shape the future of the software supply chain, and today, we’re sharing a glimpse of a powerful idea in motion: 

 server that connects large language models (LLMs) like ChatGPT and Claude directly to your software supply chain using the emerging 

Imagine managing policies, surfacing security insights, or orchestrating package workflows with a simple natural language prompt. No dashboards, no scripting, just a simple question or instruction that delivers the right end result. If this sounds interesting, you should 

This isn’t a launched product (yet), but it’s a clear signal of where we think Cloudsmith is headed: toward 

 that make it easier to control your software supply chain.

is a standard way to make information available to LLMs. Similar to an API, MCP provides a documented, standardized way for a client to integrate services from external sources.

MCP enables AI assistants to query and interact with software supply chain data, so it creates a foundation for smarter workflows and more accessible control over artifact management.

In essence, adding MCP capabilities to Cloudsmith offers up an entirely new interface to your software supply chain, with AI agents and LLMs working together to achieve your goals. We're exited to see MCP becoming a flexible new point of integration between our customers' third-party services and Cloudsmith.

MCP server demo

Our MCP prototype leverages Cloudsmith’s API-first architecture to provide programmatic access to developers through their AI assistant. Through standardized MCP requests, you can ask questions about your software supply chain or take safe, controlled actions - like managing policies or promoting packages - directly within Cloudsmith. This opens up conversational workflows with the Cloudsmith platform.

For example, you might ask your AI assistant to identify what package is trending up in usage month over month or see all of the versions of a particular package in use across your workspace. In the future, your AI assistant will be able to review your organization’s compliance and security requirements and recommend or create a set of policies in Cloudsmith’s Enterprise Policy Manager based on that input.

Building this prototype was a good reminder of a few fundamentals. First, an API-first foundation makes it easier to experiment, so it’s good that Cloudsmith is built truly API-first. Second, the data running through platforms like Cloudsmith can offer valuable insights when it’s made accessible to clients in lots of different ways. We’re giving developers and AI assistants simpler ways to ask questions, take actions, and get things done.

There’s still plenty to figure out, but MCP is already making artifact management and software supply chain management more intuitive and straightforward, especially at enterprise scale.

 for select customers and partners. If you're exploring the intersection of DevOps, AI, and supply chain security, we’d love to work with you. 

Prototyping an MCP Server

cloudsmith_series_b_V6

Today we announced Cloudsmith is officially a Series B company. This $23M fundraising round was led by 

, as well as most of our existing investors. What a vote of confidence in our team, our vision, and our market!

 in 2023 for two reasons: (1) artifact management and software supply chain security are mission-critical to enterprises, and (2) there’s an opportunity for serious disruption of JFrog and Sonatype, the two legacy players.

We now have a pile of evidence that proves this thesis. Over the past year, we’ve closed over 100% of our total pipeline at the start of each quarter. The demand is there. The average deal size is up 5x. We now boast an impressive roster of Fortune 500 and Global 2000 companies that have made the switch - on behalf of their hundreds of software teams and thousands of developers - to Cloudsmith’s cloud-native, massive-scale platform.

That kind of growth attracts investor attention. Software is the lifeblood of every company in every industry. Writing better, more secure software, and deploying it to production faster, is a massive competitive advantage. Having a bulletproof artifact management platform to power your software supply chain delivers that advantage. I’m grateful to our partners at TCV and Insight for believing in Cloudsmith as the company to provide that platform, and welcome 

Fundraising is an exciting, emotional roller coaster. It’s easy to get distracted. But we have serious work to do. It’s on us - the team here at Cloudsmith - to live up to our promises to our customers and the market. To deliver even deeper support for all popular formats across languages, operating system libraries, and containers. To provide a bridge between the CISO’s vision for security, and the VP Engineering’s need for developer efficiency. To scale up the Cloudsmith platform so we continue to be the fastest and most reliable solution on the market. To address a wider variety of deployment use cases. To make it easier to verify the provenance of artifacts that make it into your software supply chain.

 that we’d expand our customer success organization to deliver world-class onboarding services; we’d invest in engineering and innovation; and we’d expand our global footprint. We’ve done all of that and more. We’ll keep investing in our customers’ success. We want software developers to have a delightful experience selecting open-source packages. We want platform engineering teams to rely on Cloudsmith as a trusted partner in building software. We want cybersecurity professionals to lean on Cloudsmith as their key tool for implementing software usage policies.

Thank you to our investors, Cloudsmithers, and, most importantly, our customers for powering the Cloudsmith journey. Onward!

What Cloudsmith’s Series B Means for Our Customers

We can't say it enough. We have the best customers. We have an incredible support network in Belfast, Dublin, London and San Francisco. None of Cloudsmith's success in 2019 would have been achieved without 

Alan, Lee, Peter & the team at Cloudsmith.


At Cloudsmith, our goal is to make it as easy as possible to get your packages into our system from where you can manage and distribute them according to your needs.

CircleCI is a continuous integration and delivery platform that helps teams release quality code, faster. They provide a mechanism for users to share code and libraries which can be reused across pipelines called "orbs".

Cloudsmith provides first-class support for CircleCI with our official 

. Using the orb, users can easily integrate publishing to Cloudsmith with their existing CircleCI workflows.

Full reference documentation for the orb can be found on the 

. This documentation is automatically generated from the orb itself and so is guaranteed to always be up to date with the latest release of the orb.

To use the orb you must first ensure you are using Circle version 2.1. At the top of your 

You'll need to configure authentication credentials for the orb. To do so, you can add an environment variable named 

 within the CircleCI settings page for your project:

The orb (for now) requires that you have already built the package you wish to publish. Assuming you're publishing a Python library (though the same process applies to any package type), you'll want to run 

Once built, we can use the orb to easily publish the package. The orb provides a number of commands to make this process simpler. We'll first ensure the Cloudsmith CLI is configured and installed, then after we've built the package, publish it:

Putting this all together, we end up with a 

Our official orb provides simple integration for the majority of standard CI usecases, but we know that it won't fit every purpose. For additional flexibility users can mix and match commands provided by the orb and/or use the Cloudsmith CLI directly.

For example, to use the orb to install and configure the CLI, but then use the CLI directly to publish to Cloudsmith, your configuration might look like so:

As always, if you have any questions about integration or would like some general advice, please 

Paddy Carey

Principal Engineer

Cloudsmith + CircleCI

It's an exciting day at Cloudsmith HQ, today we're launching beta support for hosted private LuaRocks module repositories.

Created in Brazil in the early 90s, Lua is a lightweight language, designed primarily for embedding into other applications. Lua has a focus on speed, portability and extensibility, making it the perfect choice in many situations. Lua works equally well on all major platforms, whether you prefer Linux, Mac or Windows.

LuaRocks is the package manager for Lua. LuaRocks is responsible for downloading, building and installing dependencies, known as Rocks. The primary source of open-source LuaRocks is the 

. LuaRocks.org is a community-run hosting service for Lua modules and provides a valuable resource which is central to the Lua ecosystem. Anyone can upload Rocks for distribution, either in the main repository or in a per-user repository which is provided by the service.

Whilst LuaRocks.org is the main repository for rocks, LuaRocks provides all the necessary tooling and configuration flags to easily allow pointing at another repository if needed. Cloudsmith, as of today, can provide an alternative repository for hosting your rocks as needed.

There are a number of great reasons you may wish to run your own private repository:

To develop Lua modules internally and share them privately to other teams.

To distribute and deploy your own Lua modules in a pipeline at your org.

To distribute Lua modules as vendored software (i.e. maybe commercially).

To make modifications to public Lua modules, without republishing publicly.

To mirror public Lua modules, to isolate from uncontrolled upstream issues.

To capture the exact state of your dependencies at a particular version/release.

To control (whitelist/blacklist) the exact Lua modules allowed for your org.

To keep track of the exact versions/releases of Lua modules you have/use.

If you're interested in the possibilities that hosting your own rocks brings, then Cloudsmith is here for you. Sign up today to begin hosting and distributing your Lua modules at the world's first hosted private Lua modules repository service.

Getting started with Cloudsmith and LuaRocks couldn't be simpler. First, you'll need a Cloudsmith account and a repository to which you can upload your modules.

If you need to install Lua and LuaRocks you can find instructions on the 

Cloudsmith should work with all supported versions of LuaRocks, but we reccomend using at least 

 for the best experience. You can check your local version like so:

Next, you'll need a rock for uploading to Cloudsmith. LuaRocks has several methods for doing so, you can create source, binary or metadata-only rocks. For full documentation on creating your own rocks, see the tutorial on the 

For demonstration purposes we'll use a rock from LuaRocks.org named 

Next, you can push the module to Cloudsmith using the 

. We don't yet support uploading modules with 

, but we'll be adding support in a future release (if you want it, please let us know). For now, use the CLI.

First, ensure you've installed the Cloudsmith CLI and configured authentication:

Then, use the CLI to upload the module, which operates like 

Your repository should now contain the uploaded modules. An example of which is our official Cloudsmith examples repository (this is where we upload our examples to), as shown below:

Installing packages from a custom LuaRocks server couldn't be simpler, we only need to pass a single command-line argument to specify the location of the custom repository:

If required, you can configure the repository centrally in your 

It really is that simple, and now you've sourced a module privately from your very own private Lua module repository on Cloudsmith. Well done!

Cloudsmith provides fully featured Lua module repositories on all plans, flexible enough for use whether you’re hosting public modules for a public or open source project, or private modules for your company’s internal needs. We're extremely proud to be able to support the Lua ecosystem with this tooling.

You can find further, context-specific information, including detailed setup and integration instructions inside each Cloudsmith repository. You can see an example of this documentation in our 

Lua ROCKS!

We've had an incredible amount of growth over the past year, both as a service and as a business, establishing ourselves as a best-in-class solution for Cloud-based Package Management, and you've played a huge role in helping us get there. We couldn’t have done it without your support. Thank you so much!

By The Numbers (2019)