Platform Features

Artifact Management Software Supply Chain SecurityDistribution & DeliveryObservability & Governance

Cloud-native Artifact Management

Gain complete control over every package, container and software asset used across your business. Use Cloudsmith as the single source of truth for your work.
Unlimited packages and repositories
Use Cloudsmith to store every package, container, model and dataset.
Core package management
Use package managers or our CLI to push and pull software artifacts.
Docs
30+ formats supported
Native support for 30+ package formats, Hugging Face assets, and raw files of any type.
Docs
Private repositories
Secure access to your software artifacts using access controls and private repos.
Docs
Public repositories
Share your packages publicly or with customers using Cloudsmith Broadcasts.
Docs
Multi-format respositories
Bring related artifacts together, and manage dependencies in your preferred pattern.
Docs
Connected repositories
Link repositories together so packages resolve across them through a single endpoint.
Docs
Container registry
Bring your containers to Cloudsmith and unlock a single source of truth for all software dependencies.
Docs
Raw files
Manage files of any type and serve them along with your software packages.
Docs
Proxy and cache upstream registries
Packages pulled from OSS registries pass through checks and policies en route to developers.
Docs
Retention rules
Keep your workspace tidy and costs down by deleting unwanted packages.
Docs
Custom domains
Wrap Cloudsmith's delivery endpoints in your own domain.
Docs

Workflow Integrations

Connect Cloudsmith to your CI/CD platforms, configuration management tools and container registries using the CLI, REST API and official plugins.
Cloudsmith CLI
Configure and interact with your Cloudsmith workspace without leaving the terminal.
Docs
Cloudsmith Github action
Build software using GitHub actions and push directly to Cloudsmith.
Docs
Terraform Provider
Cloudsmith is verified Terraform provider, enabling you to configure resources automatically.
Docs
CircleCI orb
Publish packages to Cloudsmith with the help of our CircleCI orb.
Docs
Webhooks
Use a range of actions taken on Cloudsmith to trigger webhooks and third-party integrations.
Docs
Package promotion workflows
Carry out checks and then automate how packages move between your repos.
How to
CI/CD platforms
Publish and pull packages from GitLab CI/CD, Jenkins, Azure DevOps, Bitbucket Pipelines, Buildkite and more.
Docs
Configuration management
Distribute packages to your fleet with Ansible, Chef and Puppet.
Docs
Dependency update tools
Keep dependencies current from your own repositories with Dependabot and Renovate.
Docs
Canonical upstreams
Connect Docker Hub, Docker Hardened Images, Chainguard, RapidFort and WizOS as upstream sources.
Docs
Slack and Microsoft Teams
Send Cloudsmith events to the channels where your teams already work.
Docs
Datadog
Bring Cloudsmith observability data into your existing monitoring.
Docs
IDE extensions
Work with Cloudsmith from VS Code, Cursor and Theia.
Docs
MCP support
Use MCP through the Cloudsmith CLI to connect AI tooling to your workspace.
Docs
Machine learning
Integrate with MLflow and AWS SageMaker to manage your models alongside your software.
Docs
Resources

Related artifact management resources

blog

Enhance Security with Chainguard and Cloudsmith

At Cloudsmith, we are excited to announce our support for the Chainguard Registry as an upstream source. By consolidating all your artifacts, packages, and now Chainguard Images into Cloudsmith, your organization can: Reduce risk of attack with no/low vulnerability base images provided by Chainguard. Effortlessly deploy and distribute your packages and third-party dependencies using Cloudsmith's global content delivery network for optimal performance. Ensure compliance and security by establishing and enforcing rules on dependencies with Cloudsmith’s policy manager. Safeguard your workflows from disruptions caused by the removal of dependencies or outages in public repositories. Integrating the Chainguard Registry as an upstream resource in your Cloudsmith account not only enhances security but also boosts efficiency in your artifact management workflow. About Chainguard Chainguard, a Docker Verified Publisher, offers Chainguard Images which are a collection of minimal, hardened container images with impressive features: Zero CVEs Includes SBOMs and signatures Minimal, containing only the application and its runtime dependencies Using these images as your base images will drastically reduce vulnerabilities and image attack surface, saving your organization time spent triaging CVEs. Chainguard offers both a Public Registry (cgr.dev/chainguard) containing developer images and a Private/Dedicated Registry (cgr.dev/chainguard-private) which includes all versioned tags of an image and special images not available in the public registry (including FIPS images and other custom builds). Organizations using Cloudsmith with Chainguard will immediately realize developer efficiencies, unparalleled performance, and reduced risk by having Chainguard images managed directly in Cloudsmith. Upstream Proxying and Caching Cloudsmith's upstream proxying and caching capabilities offer a powerful solution for managing dependencies and enhancing security in your software development process. Upstream Proxying With upstream proxying, package managers (e.g., Docker, npm, pip) recognize packages and images stored on remote repositories (e.g., Chainguard Image Registry, Docker Hub, npm, or PyPI) as part of the Cloudsmith repository. This consolidation transforms Cloudsmith into your single contact for all third-party dependencies, simplifying your organization's build systems and eliminating the need for multiple integrations. Caching Cloudsmith excels at locating, downloading, and securely storing dependencies within its environment, ensuring optimal performance and control for your organization. Caching your upstream dependencies in Cloudsmith offers several benefits: Accelerates delivery of your packages, including third-party dependencies, through Cloudsmith's global content delivery network. Shields your workflows from public repository outages. Prevents disruption if dependencies are removed from external repositories. Minimizes exposure to risk by providing access only to dependencies with acceptable vulnerability levels and license types through fine-grained rules enforced by the Cloudsmith policy manager. Cloudsmith's upstream proxying and caching can streamline your organization’s development processes, enhance performance, and maintain control over your dependency management workflows. Check out our documentation on getting started with proxying and caching with Cloudsmith. Adding Chainguard as an Upstream Here's how you can integrate the Chainguard Registry into your Cloudsmith account: Create a Repository: If you haven't already, create a repository in Cloudsmith where you'll publish your package. Note down the Docker registry URL, which should resemble: https://docker.cloudsmith.io/v2/ORGANIZATION/REGISTRY/ Configure Upstream Proxying: In your Cloudsmith repository, go to the Upstream Proxying settings. Click the green "Create Upstream" button and select the Docker format. Provide a descriptive name for the upstream, e.g., Chainguard Public, and specify the URL for the Chainguard Registry. Enter the Chainguard Registry URL: For Chainguard’s public images: https://cgr.dev For Chainguard’s Private/Dedicated Registry: https://cgr.dev/chainguard-private Set the desired priority. Choose Proxy or Cache and Proxy: Decide whether you want to just proxy requests through to Chainguard or also cache resolved assets in Cloudsmith for future use. Configure SSL Certificate Verification: Ensure SSL certificates are verified for added security, especially for public sources. Authentication and Headers: If you are using the private URL, Chainguard requires authentication or additional headers; provide them in the respective fields. Pull a Chainguard Image with Docker Native Tooling Here’s an example of how you would pull the nginx Chainguard Docker image into Cloudsmith after you’ve configured your Cloudsmith upstream for Chainguard: Configure your Cloudsmith upstream for Chainguard using the instructions above. Ensure Docker is installed on your system. If not, go here to get started with Docker. Open a terminal. Login to Docker with your Cloudsmith username and token, with the command: docker login docker.cloudsmith.io Pull the latest Chainguard nginx image by running: docker pull docker.cloudsmith.io/ORGANIZATION/REPOSITORY/chainguard/nginx:latest Note: Replace ORGANIZATION and REPOSITORY with your Cloudsmith organization and repository, respectively. Check your Cloudsmith repository to find the newly added Chainguard nginx image. Integrating the Chainguard Registry as an upstream in your Cloudsmith account not only enhances security but also boosts efficiency in your artifact management workflow. Embrace this integration today to unlock a new level of reliability and control in your development process.

Frequently Asked Questions

Q&A about repositories, upstream caching and package management in Cloudsmith. Book a demo with our team to get answers tailored to your situation.

  1. A repository is a storage location for software packages and containers. Each repository has its own permissions, policies, upstream sources and retention rules, and you can create as many as you need.

  2. Yes. Cloudsmith repositories are multi-format, so one repository can hold packages of every supported type and related artifacts can live together. You can create as many repositories as you need.

  3. Connected repositories link multiple Cloudsmith repositories so packages from all of them resolve through a single repository and a single endpoint. Packages are visible as soon as they are pushed, with no indexing delay, and you set a priority on each connection to decide which repository wins when the same package exists in more than one. Upstreams configured on connected repositories are inherited too. The feature is in early access, supports formats including Maven, Docker, Python, npm, Go, Cargo, NuGet, Helm, Conan, Conda, Generic and Nix, and works between repositories in the same workspace.

  4. Connected repositories are Cloudsmith's equivalent of virtual repositories. In JFrog's model, virtual repositories re-resolve metadata on every pull and are restricted to a single package type per virtual repo. Connected repositories are built on Upstreams, so packages are available instantly and one URL serves every format.

  5. Cloudsmith can proxy packages from upstream registries such as PyPI, npmjs and Docker Hub, and optionally cache them in your repository. Cached dependencies stay available during upstream outages and give you visibility into what your teams pull.

  6. Retention rules automatically delete packages that exceed a repository's configured limits for count, age or total size, which keeps your workspace tidy and storage costs down.

  7. Yes. Custom domains can be account-wide, working across all repositories in your organization, or per-repository, for a single repository.

  8. Yes. Cloudsmith includes a Docker registry where you can push images, and you can configure upstream Docker registries and cache the images your teams request.

  9. Each repository has its own settings for access controls, upstream proxying, retention rules, Geo/IP rules, entitlement tokens, EULA enforcement, custom domains, webhooks, signing keys, license compliance and security scanning. Audit logs, client logs and usage statistics show you what happens inside it.

We are here to help!
Speak with one of our experts to see Cloudsmith’s feature set in action and get tailored advice to fit your use case