 tab lets you proxy and cache hardened, minimal container images without manual format/URL entry.

Pre-configured upstreams are available for the DHI Community and Chainguard Containers Free tiers.

For paid tiers (DHI Select/Enterprise, Chainguard Containers, and WizOS), the proxy URL is pre-filled automatically. Just select the card, name your upstream, and add credentials where required.

For more information, see our integration guides for 

Other hardened image registries can still be added as upstreams by using manual configuration. To register interest in additional quick configure vendor support, please 

You can now apply cooldown policies to NuGet packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny.

You can create cooldown policies via the Cloudsmith API, Terraform provider, and web app.

This feature is available in early access for Ultra and Enterprise customers.


Cooldown policies are now supported for npm, Python, Go, and NuGet. For more information about using cooldown policies, see 

Cooldown policies now support NuGet

 partner program. This integration helps prevent unauthorized use of your API keys by automatically detecting exposed keys before they can be exploited.

Cloudsmith issues API keys with a unique prefix. That prefix is registered with GitHub's secret scanning infrastructure, so when a Cloudsmith API key appears in a repo – in source code, a config file, a committed 

, or anywhere else GitHub indexes – GitHub detects and flags it automatically.

If a leak occurs, Cloudsmith notifies the affected user and workspace owners directly to rotate the compromised key immediately.

Secret scanning runs automatically on public repositories for free. For more information about GitHub secret scanning for private repositories, see 

GitHub Docs: Secret scanning - How can I access this feature?

Cloudsmith API keys are now detectable by GitHub secret scanning

, allowing Python package clients to fetch only metadata from the Simple API during dependency resolution.

Cloudsmith's Python Simple API index now includes .metadata links alongside package distribution files. When a compliant client like uv resolves dependencies, it fetches only the small metadata file for each candidate package rather than downloading the full archive. This allows the full dependency tree to be resolved efficiently upfront.

Previously, Python clients had to download entire packages just to read their dependency metadata. This put unnecessary strain on upstream caches and caused builds to be slow and unreliable.

Customers using Cloudsmith Python repositories with the Python Simple API enabled.

Speed up Python builds with PEP-658 support

You can now apply cooldown policies to Go packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny.

This feature is available in Early Access for Ultra and Enterprise customers.

For more information about using cooldown policies, see 

Cooldown policies now support Go

Cloudsmith now handles authentication for Docker Hub and Docker Hardened Images (DHI) upstreams using a managed token, removing the need to supply your own credentials during setup. Authenticated requests receive a higher rate limit than anonymous access.

When a Docker Hub or DHI upstream is created without credentials, Cloudsmith uses a managed Docker Hub organization access token (OAT) to authenticate requests on your behalf. Workspace names are shared with Docker to attribute usage when the Cloudsmith-managed token is used.


A pre-configured DHI upstream is also available, so you can start proxying and caching images from the DHI Community tier immediately.


 are minimal, secure, and production-ready container base and application images maintained by Docker. Designed to reduce vulnerabilities and simplify compliance, DHI integrate easily into your existing Docker-based workflows with little to no retooling required.

For more information about creating Docker Hub and DHI upstreams in Cloudsmith, see:

Set up Docker Hub and DHI upstreams with Cloudsmith-managed authentication 

 now supports dark mode. If you spend time in 

, which has long had dark mode support, switching over to the documentation site no longer means a jarring change in theme.

System theme: the docs will automatically match your operating system's light or dark preference.

Manual toggle: a theme toggle in the footer lets you switch between light and dark mode independently of your system settings.

We think the new dark mode looks very handsome. Enjoy!

Hardened images tab for configuring upstreams

Other logs

Cooldown policies now support NuGet

Cloudsmith API keys are now detectable by GitHub secret scanning

Speed up Python builds with PEP-658 support

Cooldown policies now support Go

Set up Docker Hub and DHI upstreams with Cloudsmith-managed authentication

Dark mode now available for Cloudsmith docs