Cloudsmith loves open-source software (OSS). There, I said it.

Our co-founders, Alan Carson and Lee Skillen, recognized from the beginning that smart reuse is a core value of the software community. Companies that make developer tools have a special obligation to support OSS, which in the case of Cloudsmith means 

 (OpenSSF). It also means giving back to the community by hosting OSS repositories, and providing distribution capabilities.

 is one of our earliest and most popular features. Any Cloudsmith user - even those on our free Core plan - can create OSS repositories, which we track separately from your public or private repos. OSS repos get 50GB of storage and 200GB of monthly bandwidth for free, as long as you attribute Cloudsmith in your readme. (There are a 

 - specifically, client logging and geo/IP controls - to every OSS repo hosted by Cloudsmith. We recognized that OSS maintainers need these controls, especially as their libraries gain popularity.

 is a wake-up call for software companies. Most commercial software products are built on top of mountains of OSS; and by some estimates, up to 90% of all deployed production code is sourced from an OSS library. There are legitimate questions being asked today about whether commercial entities are doing enough to support the development and maintenance of the OSS that we all rely upon, and ultimately need to trust.

Cloudsmith is a foundational tool in protecting and securing the software supply chain. Organizations large and small use Cloudsmith to ensure they can have a single source of truth, and control the flow of every software ingredient that ultimately lands on their production servers and client devices. The explosion in OSS has demonstrated the need for security-oriented tools like Cloudsmith. While we help customers protect against vulnerabilities that can sneak into OSS, we also believe it’s part of our mission to support healthy development and distribution of OSS.

Like the headline on this blog says - Cloudsmith ♥ OSS.

Glenn Weinstein

Cloudsmith ♥ OSS

KubeCon + CloudNativeCon Europe 2024 in Paris was one of the biggest tech conferences in the world and attracted over 12,000 people this year!

It’s a big community hug fest to celebrate open source projects, contributors and users on Cloud Native projects. It’s also a place where SRE, platform engineers, DevOps engineers, developers, and businesses interested in or using Kubernetes and Cloud Native technology get together to explore the latest trends, share insights and connect in person with friends, colleagues, customers and fellow enthusiasts.

It seems like all of life happens at KubeCon!

I work in Developer Relations in Cloudsmith and they are a big supporter of the Cloud Native Computing Foundation (CNCF) mission. My goals were to engage with attendees at the Cloudsmith booth, give demos of our platform, talk to our current customers, meet with potential partners, and attend as many talks as possible in the area of supply chain security.

A lot of people at the event, including myself, work from home a lot and you could sense that people were enjoying talking to friends, colleagues, fellow maintainers, and attendees face to face.

I felt buzzing returning home—full of ideas, new contacts and a better understanding of the cloud-native landscape.

Keynotes: Celebrating 10 years of Explosive Growth

The Kubernetes project celebrates a decade of remarkable growth, boasting a staggering 190k-member Slack group and over 3.2k active contributors on Github. With over 100 certified Kubernetes distributions, and 200k+ Certified Kubernetes Administrators (CKAs), the ecosystem thrives. Much of the keynotes, including Bob Wise’s closing speech, were spent celebrating the success of the community over the last 10 years.

But CNCF are not resting on their laurels—AI, sustainability, security, and edge computing were laid out as the cornerstones of Kubernetes development in the coming years. CNCF really doubled down on AI in the keynote speech and published an 

Kubernetes maintainers want to ensure the platform evolves to meet the needs of the end-user community, including new workflows like the AI. Solomon Hykes, Founder of Dagger, echoed this sentiment, urging a higher standard in deployment practices. “We have to remember we are not there yet and we need to set the bar higher,” he said. “A bunch of scripts gluing terraform and 30 other tools together—it’s not supposed to be like that and we have some work to do.”

In his closing keynote, Hykes emphasized following a model of manufacturing and working on the build process of software to continuously improve the 'software factory'. We "need to set a higher bar and think of it as an integrated process".

He called to elevate the software build process and underscored the collective commitment to continuous improvement in CNCF.

The projects and maintainers are the heart of the CNCF ecosystem. CNCF aims to help open-source projects including Kubernetes, Prometheus, Envoy, and over 180 other projects to thrive. Projects are labeled Sandbox, Incubated, Graduated and Archived. These labels help organizations choose an appropriate project for their use cases. Graduated and incubating projects are considered stable and are used successfully in production environments. The 

Graduated project released an update video

These are some of the CNCF projects that are in my ballpark (artifact management, CI/CD and supply chain security):

, an official fork of Terraform, which arose when Hashicorp announced they would change the license of many of their open source tools;

, a continuous delivery solution for Kubernetes;

, Kubernetes-native tools to run workflows and manage clusters;

, a framework for securing software update systems;

, an open source, general-purpose policy engine;

, a framework to protect supply chain integrity; and

There were 223 talks spread across 10 tracks. It was impossible to attend all of them, but CNCF were great at quickly uploading the talks to YouTube. The following sessions focused on the topic of supply chain security, CI/CD, and package formats:

: Perspectives on Cloud Native Supply Chain Security. There's been a surge in attacks targeting the software supply chain. While SBOMs are a crucial step, they're currently more of a compliance checkbox than a robust security measure.

OCI as a Standard for ML Artifact Storage and Retrieval

Lessons Learned from Generating 100M SBOMs

 - Kairo De Araujo, TestifySec & Fredrik Skogman, Github. On how you can use the TUF framework to secure your production delivery systems.

GitOps Continuous Delivery at Scale with Flux

Open Policy Agent (OPA) Intro & Deep Dive 

- Anders Eknert, Styra & Xander Grzywinski, Microsoft

 - Adrian Mouat, Chainguard. Adrian goes through the different ways of building usable but minimal Docker images with a low number of CVEs.

VEXinating Your Container Images: The European Way

 - Dina Truxius, Federal Office for Information Security (BSI) & Jose Antonio Carmona Fombella, VMware. On automating vulnerability management with open source tooling.

Kubernetes Maintainers Read Mean Comments

- Tim Hockin & Davanum Srinivas. A reminder to be kind to the volunteers that maintain Kubernetes even when it frustrates them.

 One of the standout themes of the conference was the growing importance of AI/ML on Kubernetes. In reality, AI is not yet a disruptor in the cloud-native world, but the start point seems to be preparing the platform for AI workflows.

 supply chain security as opposed to talking about it as a concept.

Managing resources to be more sustainable and reduce cost:

 WebAssembly and Pod autoscaling in Kubernetes were everywhere talking about solving this problem. There was much buzz about Spin, a new CNCF project working on WebAssembly, to develop and deploy WebAssembly workloads on Kubernetes more sustainably by reducing memory consumption significantly.

This was a hot topic. There were loads of stands at the showcase, and massive queues out the door for Cilium’s signed books and talks.

: A push for cloud-native pipelines to become a platform using programming languages (AKA not YAML) with a regular language with well written API docs and SDKs.

As HashiCorp contemplates a potential sale, there's uncertainty over Terraform's future direction. In this environment, OpenTofu, a fork of Terraform, was another top trending topic at KubeCon.

Simplifying application management and the path to production with Kubernetes:

 This continues to be important in talks and on the showroom floor.

KubeCon is a great event to connect with the community, celebrate what has been achieved, and illuminate the path forward for the cloud-native community. Cloudsmith will be attending KubeCon North America in Salt Lake City later this year, and I hope to see you there!

Ciara Carey

Solutions Engineer

That's a Wrap on KubeCon 2024!

As I wrap up my second week as the CMO of Cloudsmith, I'm already struck by the incredible talent and passion that pulses through our team. Last week at the 

, this impression was not only confirmed—but amplified—as Cloudsmith clinched not one, not two, but three prestigious awards: Business Personality of the Year, Scale-Up of the Year, and Small Tech Company of the Year (highly commended).

Spearheaded by MCS Group, the Digital DNA Awards serve as a celebration of excellence and innovation within Northern Ireland's tech sector. They honor the trailblazers, both individuals and organizations, who are driving digital transformation forward and reshaping the landscape of technology.

Acknowledgement always feels great, but evidence-based awards like these are also an important reminder and reassurance for our customers, partners, investors, and peers that Cloudsmith is shaking things up in tech in a meaningful way. They signify that we're delivering on our ambitions and promises to you; that you can trust our commitment to quality and improvement; and that we have the vision, structure, leadership, and support necessary to continue on this exciting upward trajectory.

Scale-Up of the Year: Driving Innovation Forward

Cloudsmith's recognition as the Scale-Up of the Year is more than just an accolade—it's a testament to our unwavering commitment to pioneering new ideas and achieving the highest standards. With a recent $11 million (£8.8 million) Series A2 investment round fueling our expansion, this award underscores our rapid growth and success in scaling operations while prioritizing quality and customer satisfaction. For our valued customers and partners, this means even greater access to cutting-edge DevSecOps tools and solutions tailored to your evolving needs.

Business Personality of the Year: Leadership Excellence

A heartfelt congratulations to our CEO, Glenn Weinstein, for being honored as the Business Personality of the Year! Hailing from the bustling streets of New York City, Glenn stepped into the leadership role at Cloudsmith in mid-2023 and swiftly made Belfast his second home. His embrace of the local culture and tech community, coupled with his relentless drive, exemplifies the spirit of innovation and collaboration that defines Cloudsmith as a trusted partner in the industry.

Small Tech Company of the Year: Recognizing Impact

We're thrilled to receive commendations as the Small Tech Company of the Year! An award for the companies that are disrupting their market or industry, this recognition underscores our significant contributions to Northern Ireland's tech ecosystem and beyond. But what does this mean for our customers and partners? It means access to best-in-class artifact storage, management, and distribution solutions that streamline the software supply chain and accelerate product delivery. It means empowering organizations worldwide to innovate faster, collaborate seamlessly, and stay ahead in today's dynamic digital landscape.

I am truly honored to be part of the Cloudsmith family and to contribute to the flourishing digital ecosystem of Northern Ireland. Our journey of innovation and excellence continues, fueled by the remarkable talent and dedication of our team, customers and partners.

Lee Skillen

Chief Technology Officer

Cloudsmith Shines Bright at Digital DNA Awards

At Cloudsmith, we recognize the importance of maintaining control and reliability over every aspect of your organization's software, including its dependencies. That's why we're thrilled to introduce support for 

This means that your organization's developers can effortlessly upload R packages, while Cloudsmith handles the retrieval and caching of its dependencies. Let us reliably and securely be the single point of contact for all your packages.

R is a powerful programming language and environment widely used for statistical computing and graphics.

CRAN, or Comprehensive R Archive Network, serves as the primary repository for R packages, providing a vast collection of resources for R users and developers.

 hosts a vast collection of R packages contributed by developers worldwide, covering a wide range of domains such as statistics, machine learning, data visualization, bioinformatics, and more.

These packages are generally available in both source code and precompiled binary formats. Source packages contain the original R code, documentation, and any necessary dependencies, allowing installation on any platform by compiling them locally. Precompiled binaries may also exist for Windows and macOS platforms, making installation straightforward for users without the need for compilation. These binaries are optimized for their respective platforms, enhancing performance and ease of use.

With Cloudsmith's CRAN upstream proxying, we act as your single point of contact for all R packages and dependencies. By proxying upstream dependencies located in CRAN, we simplify integration by consolidating access to packages through our platform.

This means your organization can ensure reliability and only have to deal with a central place, Cloudsmith, instead of managing multiple connections to external repositories.

When you add a CRAN upstream in Cloudsmith, we’ll do several things behind the scenes that’ll allow you to start pulling R packages (in both source or binary format) right away:

We’ll check what packages are available on the upstream

We do this for all source packages and binaries built for specific versions of R, platforms (macOS or Windows), and architectures (for macOS binaries only).

Once complete, this allows you to take advantage of two powerful features of Cloudsmith, Proxying and Caching.

When you attempt to pull an R package from Cloudsmith and it doesn’t exist within your repository, we’ll check if it exists on the upstream. If it does, we’ll transparently serve it. No more specifying multiple repositories within the R console when installing an R package.

Even better, if you’ve got multiple CRAN repositories, add them as upstreams within Cloudsmith. Specify which repositories Cloudsmith should check, set the precedence or priority between them, and define actions in the event of an upstream failure. You’ll always be in control of your dependency management.

If you’ve configured the upstream to cache any packages you’ve fetched, when you fetch a package it’ll be stored in your Cloudsmith repository. No more fetching from the wild.

This gives you greater visibility and control about what packages are being fetched, access to package scanning and monitoring, and lightning-fast and reliable access to your most important dependencies.

Benefits of CRAN Upstream Proxying and Caching

 Lightning-fast delivery of dependencies from our cached repository no matter where you are in the world.

 Ensure consistent and reliable access to dependencies worldwide.

 Having a secure central location for consuming all your organizations R packages and dependencies. One place to monitor, 

 Consolidate access to R packages through Cloudsmith. Your Cloudsmith repository is the only repository you need to configure.

At Cloudsmith, we're committed to empowering developers with tools that make software development simpler, faster, and more secure. With CRAN upstream proxying and caching, we're taking another step toward achieving that goal.

Ready to streamline your organizations R package management with Cloudsmith's CRAN upstream support? Check out our 

Let's build better software together, with Cloudsmith.

Jack Gibson

Senior Software Engineer

Caching and Upstream Proxying For CRAN's R Packages

Securing Excellence: A Personal Perspective from Victor Suarez, IT Operations Manager

As the IT Operations Manager at Cloudsmith, it gives me immense pleasure to share the exciting news that we have successfully completed our surveillance audit for ISO 27001:2013. This global standard for Information Security Management Systems (ISMS) has been a cornerstone of our commitment to security, and I'm thrilled to provide a personal perspective on this achievement.

The road to ISO 27001:2013 recertification was not just a routine audit; it was a journey fueled by our collective dedication to elevating our security standards. Embarking on what we fondly called the "Year of Security" in 2021, the entire Cloudsmith team worked tirelessly to ensure that our security practices aligned with the highest international standards.

ISO 27001:2013 is not just a certification; it's a testament to our commitment to you, our valued customers. It signifies that we have implemented a comprehensive framework that goes beyond IT, covering every aspect of our organisation - people, processes, and controls. Your data's security is our top priority, and this recertification is the proof of our unwavering dedication to ensuring its integrity and privacy.

In essence, ISO 27001:2013 is the gold standard, and obtaining certification is not just a validation of our existing practices but an acknowledgment of our continuous efforts to enhance our security posture. It's about instilling confidence in you, our customers, that when we say we take security seriously, we mean it.

I want to express my gratitude to the entire Cloudsmith team for their hard work and commitment throughout this journey. Achieving ISO 27001:2013 is a collective triumph, and I am proud to be a part of a team that values security excellence.

As we step into the future, rest assured that Cloudsmith remains steadfast in its pursuit of security excellence. We are not merely meeting standards; we are setting new benchmarks to ensure that your trust in us is always well-placed.

I'm genuinely excited about what this achievement represents - a fortified commitment to security, a collaborative effort, and a promise to continue exceeding your expectations. Thank you for entrusting us with your data security, and we look forward to delivering even greater security excellence in the years to come.

Cloudsmith Achieves ISO 27001:2013 Recertification

Optimized for distributed teams working at any scale, Cloudsmith is your single source of truth for software assets. Proxy and cache to public upstreams, and use our Zero Trust model to control access to your most valuable IP. We’ve spent years creating the industry’s only true cloud-native solution to global software distribution at any scale. Let’s get you shipping without friction!

We are bringing a team of software supply chain experts to KubeCon including our CEO 

. Our on-site team can provide tailored advice to your team’s unique situation.

On-site demo spots are going fast so be sure to 

Free Software Supply Chain Security consultation

Stop by our booth to grab a voucher for a free 1-hour Software Supply Chain Security consultation. Let our team show you how you can swap risky development practices and insecure pipelines for end-to-end software supply chain control and security with Cloudsmith after KubeCon has ended. Spots are limited!

Stop by our booth to take our software supply chain security survey for your chance to win a MacBook Air and grab some of our awesome Cloudsmith swag!

 to bring you this year’s passport program! Grab a card from any participating sponsor booth and collect stamps for your chance to win a Meta Quest 5, Playstation Portal Remote or LEGO Paris Architecture Set.

Claire Speedy

Senior Marketing Manager

Cloudsmith is headed to Paris for KubeCon Europe 2024

. In that time, I’ve learned a lot from our customers that I’d like to share.

The world needs a SaaS artifact management platform. 

Large software development teams want and need Cloudsmith. We’re the only enterprise-scale multi-tenant SaaS alternative to the two main products that have dominated market share over the past decade - JFrog Artifactory and Sonatype Nexus. Many of our customers and prospects tell us they’re anxious to switch to a cloud-native SaaS backbone that's inherently multi-tenant, where the vendor (that's us) manages one massive-scale instance that serves all customers.

There’s a real market for well-built, developer-friendly artifact management tooling.

 Our competitors are building horizontally. They’re adding native tools for things like CI/CD and security scanning. We fundamentally believe differently. We think developers want to use best-of-breed DevOps tools from vendors like Harness, CircleCI, Snyk, and Chainguard, rather than be pushed into accepting versions of these tools from their artifact management vendor. So we focus on integrating with, rather than competing against, the most innovative companies in the DevOps ecosystem. And we can do this better, because we’re SaaS.

Better artifact management is at the core of software supply chain security. So we’re laser-focused on building a truly great artifact management platform. One that developers and DevOps teams love. That’s built to work at web scale, without the infrastructure hassles. And we’re finding that developers agree!

The early appeal of Artifactory and Nexus was to provide a local copy of artifacts, just in case the original source was temporarily unavailable. That was a “nice to have,” but artifact management has morphed into a “must-have.” I’m seeing four key trends driving the elevation of this requirement -

The explosion in use of open-source software (OSS) as ingredients in the software supply chain. Where developers 10+ years ago might have used a few OSS packages here and there, today OSS makes up as much as 90% of all deployed code in production.

The rapidly growing threat environment in popular OSS registries like npm (Javascript), pypi (Python), Maven Central (Java), NuGet (.NET), and Docker Hub. Malware and other vulnerabilities are lurking all across these indexes, and the bad guys are getting smarter and more aggressive.

The rise of containerization, along with the ubiquitous use of publicly-sourced containers as building blocks.

The recognition of the need to methodically structure and control the software supply chain, leading to standards like Supply-chain Levels for Software Artifacts (

) and Secure Supply Chain Consumption Framework (

Developer-native software distribution is a game-changer.

 Many of our largest customers rely on Cloudsmith to deliver free and paid versions of their own SDKs and packages, relying on a combination of Cloudsmith repos, our global package delivery network, and our entitlement tokens to gate and monitor downloads. Our capabilities here go well beyond what’s available from traditional artifact management vendors, and it’s a natural extension of our platform since we’re already cloud-native SaaS.

“Me-too” artifact managers are nice, but you quickly outgrow them.

 We’ve seen the hyperscalers and source code platforms release their own artifact managers in recent years. But we’re finding their ambition and feature breadth to be more suited to small teams, rather than the enterprise-scale development teams Cloudsmith is built for. Using a hyperscaler-native tool like AWS CodeArtifact may be a good way to get started, but limited format support, analytics options, vulnerability scanning, and customizability seems to quickly push dev teams to look for more dedicated artifact management tools like Cloudsmith.

We’re committed to doing one thing - being the world’s software supply chain - and doing it incredibly well. 

A CEO’s Reflections: 6 Months In

 is exciting! The promise of a better work life and smoother software production is within reach. But given artifact management’s position at the center of your CI/CD process, we also know there’s a lot at stake if you choose the wrong solution.

To make your shortlisting and selection more successful, I’m here to arm you with info about the features and services that define truly modern artifact management tools. These are game-changers for streamlining your development pipeline and elevating your DevOps team's efficiency. I’ll also describe what good looks like, so that you’re better equipped to compare and evaluate your options.

Mature organizations commonly use multiple programming languages in their software. This is great for developers, who get to code in the formats they know inside-out, but it can be a nightmare for your operations teams that have to manage that plethora of tooling. Creating, maintaining, and updating access, security, integrations, etc, across multiple management environments is repetitive, time-consuming, and error-prone. Workflow complexity becomes dizzying, as every package format’s native tooling has different limitations that necessitate unique configuration. Finally, the more touch points there are in a system, the more likely it is that something can go wrong.

A tool that can store, manage, and secure ALL of your organization’s package formats, together, allows your DevOps team to focus on delivering high-quality software without the hindrance of format-specific package management. By centralizing your assets in a single platform, you can:

streamline monitoring, ops, and workflows;

introduce consistent dependency management;

increase knowledge sharing and cross-team collaboration;

enable teams to adopt a consistent set of commands and practices, which leads to faster development cycles;

effortlessly enforce identical security practices with all asset types.

A quality solution that claims universal format support will:

cover of all of the major programming languages (expect 20 languages at minimum);

accommodate operating system packages like Windows and Linux; and

, which give you ultimate flexibility to organize your storage however makes most sense to you. For example, you might group by languages to simulate the workflows in familiar public repos, or you might instead group packages by team, by project, by environment, or by status (eg, scanned and approved vs unauthorized).

The importance of dependency management is well established in DevOps. Reliance on external libraries, frameworks, and packages to cut development time and effort is standard practice in our industry, but what we gain in efficiency we lose in security and stability. External dependencies suddenly become unavailable; are vulnerable to malware (especially public OSS packages); and their code is constantly evolving, which can jeopardize our software’s functionality and performance. We use tools like npm, Maven, and Java to manage dependencies—tracking and retrieving the correct versions for our builds—but version control is only the tip of the iceberg when it comes to protecting this portion of our software supply chains.

To increase the safety of the external components entering your pipelines, choose an artifact management platform with dependency firewall functionality. The power to apply forensic checks and controls to all of your dependencies will:

When comparing package management tools, I recommend you look for:

upstream package proxying and caching as a moat to protect your infrastructure from dangerous packages and external outages;

automated security scanning—upon initial upload and every promotion—including:

support for policy enforcement. In other words, make sure that you can customize how to handle security threats according to 

 policies—for example you might want to block all high-severity dependencies from download or create rules that quarantine medium-severity threats for examination but ignore low-severity threats; and

an API that inspects digital signatures and checksums, so you can detect unauthorized changes to dependencies and verify that teams can only use the desired version.

When you build with commercial and open-source third-party assets, most come with a EULA—a legal agreement defining how you’re allowed to use, modify, and distribute that software. Early awareness of and consistent adherence to every asset’s T&Cs is critical. Otherwise, your organization exposes itself to uncertainties over IP ownership and distribution rights (in the best case) and to the possibilities of lawsuits, fines, injunctions, and a commercially unusable product (in the worst cases). Take a copyleft license like the GNU General Public License, for example. If an OSS package with this license makes its way into your software, suddenly your IP is no longer your exclusive IP. Others technically have the right to freely modify and distribute your work. Yet manually monitoring and managing a high volume of software licenses is impractical.

Top-quality artifact managers include the feature sets you need to replicate your company’s licensing policies in your package management workflows. This helps protect you by:

making it easy and efficient to enforce your license policies across all teams;

preventing the legal, financial, and reputational risks associated with breach of contract; and

reducing the rework and delays that result from late discovery.

To choose a solution that takes license compliance seriously, keep your eyes peeled for:

features that let you specify which precise licenses are permitted to enter your pipeline and which are not;

controls to define policy rules and automate actions on how to handle packages with missing licenses, unknown licenses, and recognized licenses that don’t meet your policy requirements (eg, flag, quarantine for review, deny);

a robust schedule of policy compliance checks—for example, automatic checks whenever a package is uploaded, moved, copied or cached; and

at-a-glance reporting and a dashboard of license metrics, so you can:

monitor and audit the compliance status of your pipeline; and

quickly sort and ID all packages that use a license that no longer fits new policy updates.

Your company’s software teams and developers are probably distributed across dozens—or even hundreds—of locations. What’s more, the rise of cloud-native CI/CD means that many of the processes that your packages feed into (and emerge from) live in the cloud. So when you have people and processes that are fully remote, yet your packages are on-premises or merely cloud based, availability, performance, and productivity suffer. Engineers struggle to collaborate and access packages at the rate they need. Everyone gets hampered by downtime delays and slower build processes. And costs spiral for DevOps because you have to spend so much money and effort standing up instances around the globe; dealing with VPNs, clustering, and CDNs; and maintaining and scaling your package manager.

Cloud-native solutions like Cloudsmith, on the other hand, alleviate these pains, dramatically simplifying and optimizing the way teams work. They’re turnkey. They’re built from the ground up to capitalize on today’s cloud capabilities and the marvels yet to come. And while the benefits of cloud-native package management solutions are vast, a few notable perks include:

higher reliability—they’re built for availability and reliability on a 

 scale, ensuring that the smallest customers benefit from the same infrastructure investments that are supporting the largest customers;

faster software delivery and distribution;

greater competitive advantage—because teams now have the bandwidth to rapidly react to changes in the market and the reliability and performance they need to release more quickly;

instant platform enhancements—cloud-native platforms release new and improved features that are immediately available to users without the need for an upgrade project;

a consistent user experience everywhere in the world; and

cost savings, thanks to a lower total cost of ownership.

Don’t confuse a cloud-based platform for a cloud-native platform. This might be the biggest gotcha in choosing a new artifact management solution. The terms ‘cloud hosted’ and ‘cloud based’ have emerged as a smokescreen to disguise on-premises enterprise platforms that have simply been hosted on the cloud, as separate single-tenant instances. This means scaling up for heavy loads, and delivering globally as a CDN, will be more challenging and put more onus on the customer. 

The simplest way to tell whether a platform is cloud native or cloud based is to ask vendors outright. But if they’re evasive, know that a cloud-native solution has:

built-in high availability, so you don’t need to specify up front what geographies you might need to support or how much load you think you might need to scale for;

automatic scaling without intervention by DevOps—ideally with elastic load balancing and node layers that instantly increase capacity as service demand rises;

multiple data centers, regions, and availability zones—with redundancy built in at each service layer and platform layer.

Self-managed package management solutions divert valuable time and resources away from core development and deployment activities. They require your DevOps team to handle tasks such as server provisioning, configuration, updates, and scaling on its own. These substantial overheads make it hard to maintain a stable and secure infrastructure because day-to-day upkeep quickly becomes your full-time occupation, leaving little resource left to keep pace with evolving security threats or adopt new features and improvements.

A fully managed artifact management solution, on the other hand, offers numerous benefits, including:

more time for your team to focus on strategic initiatives;

up-to-date security patches and performance optimizations.

When evaluating package management platforms, check for these specific features and functionality to see if a tool is truly fully managed:

automated scaling—a fully managed platform should dynamically scale resources based on demand to ensure optimal performance during peak usage periods;

availability metrics—compare vendors’ 

 for uptime, performance, and incidents to determine which is delivering the most reliable, hassle-free experience and whether the platform is being fully managed 

integration with popular CI/CD tools so that it will seamlessly incorporate into your development pipeline.

built-in monitoring and analytics tools for insights into your usage patterns and potential issues.

I hope this list helps you flesh out your selection matrix, equips you for conversations with vendors, empowers you to make smart decisions, and sets your team on a path to success. Good luck, happy shopping, and if you’d like to add Cloudsmith to your mix of artifact management solutions to explore, start a fully-featured 

 and we’ll happily answer all of your questions!

Alan Carson

Co-founder and Chief Strategy Officer

6 Essential Features for Your Next Artifact Manager

Cloudsmith proudly introduces support for private Hex package repositories, marking a significant milestone in supply chain security and package management for Erlang and Elixir teams.

With Cloudsmith, you can manage, develop and distribute your Hex packages in your own private Hex registry using familiar tooling, ensuring seamless integration into your existing workflow.

Our fully managed platform provides global distribution for remote teams, with 410 points of presence around the world, ensuring elasticity to scale with your team's needs.

Enjoy peace of mind with built-in security scanning for malware and CVEs, and define how to handle low, medium, and critical issues.

Plus, our transparent pricing makes Cloudsmith affordable for teams of all sizes, and you'll receive quality Engineer led support, ensuring a smooth experience from start to finish.

Cloudsmith Blog

Cloudsmith ♥ OSS

That's a Wrap on KubeCon 2024!

Cloudsmith Shines Bright at Digital DNA Awards

Caching and Upstream Proxying For CRAN's R Packages

Cloudsmith Achieves ISO 27001:2013 Recertification

Cloudsmith is headed to Paris for KubeCon Europe 2024

A CEO’s Reflections: 6 Months In

6 Essential Features for Your Next Artifact Manager

World's First Private Hex Repository with Cloudsmith

How to Audit Your Software Supply Chain Security

Cloudsmith Navigator: The Trusted Guide to OSS Package Quality

Improving Observability With Cloudsmith Logs