We’ve added support for the Wolfi ecosystem, alongside the ability to proxy and cache both Alpine and Wolfi packages from their public mirrors. For teams installing packages via APK, this provides a simpler, more reliable way to manage dependencies by using Cloudsmith as a single source for both public and private packages.
Simplify your APK workflows
Managing public and private packages separately adds friction to your build process. Cloudsmith removes this by blending your local packages and upstream content into a single, unified APKINDEX.tar.gz.
By merging these into one index signed with your repository’s RSA key, you also improve your software supply chain security. Your build environments only need to trust one source to verify the integrity of every dependency in your stack, whether it’s an internal artifact or a public package.
How it works
Cloudsmith treats each upstream as a separate distribution within your repository to ensure packages are correctly indexed and served.
- Alpine Linux: We provide complete coverage across all architectures and every supported branch (from v3.0 through v3.23 and beyond).
- Wolfi: We index everything currently available on the Wolfi OS index, covering all packages available within the last 12 months, plus anything you've cached or uploaded directly.
Wolfi doesn't use versioned branches, and public packages are typically only maintained upstream for 12 months before removal. This can make it difficult to reproduce older builds or maintain long-term consistency.
When you pull Wolfi packages through Cloudsmith, we cache them permanently. This ensures your builds remain reproducible even after the packages disappear from the public upstream.
Getting started
To begin proxying these repositories, add the following URLs as upstreams in your Alpine-compatible repositories:
- Alpine Linux:
https://dl-cdn.alpinelinux.org/alpine/ - Wolfi:
http://packages.wolfi.dev/os
Check out our documentation for more information.
