Artifact management with Cloudsmith

Every package. Every container. Every pipeline. Every team.

Packages, containers, ML models and assets end up scattered across tools nobody fully owns, each with its own maintenance burden. Cloudsmith gives you one control plane, and one source of truth, for everything moving through your pipelines.

Universal format support

Every extra tool is another thing to patch and maintain. Cloudsmith is one secure store for every package, container and asset you run.

  • Support for 30+ software package formats
  • Docker container registry as standard
  • Centralize ML model management alongside packages
  • Support for raw files and assets of any type

Native package tools

No new tooling to learn: push and pull packages with the native language and OS tools your team already uses.

Command-line interface

Get hands-on with your workspace from the command line. No context switching, no waiting on a UI.

Package insights

Flying blind on what's inside a package stalls policy decisions. Extract license, dependency and quality metadata automatically.

Package signing

Unsigned artifacts are a trust gap. Sign every package so what ships is verifiably what you built.

Powerful Features. Simple Control.

We’ve had no platform-impacting downtime for our artifact repository since migrating to Cloudsmith.

Dave Bresci

Senior Manager of Site Reliability Engineering

Before

PagerDuty were suffering with pipeline disruption and support bottlenecks. They needed first-class performance and developer-friendly service.

With Cloudsmith
  • Fully managed artifact management
  • Highly available solution
  • Fast, friendly service
Results
  • 50% cost savings
  • Reliable pipeline stability
  • Better, faster issue management

Secure Container Registry

A separate container registry means separate infrastructure to maintain. Store containers alongside every other format in one fully Docker-compatible registry.

  • A feature-complete Docker implementation allows you to push and pull images as you would with Dockerhub
  • OCI-compliant architecture built to support containers of various formats long into the future

Repository sprawl rarely happens by design, it just accumulates. Structure repositories the way your teams actually work, and move packages between them with promotion rules.

  • Structure repositories in your desired pattern
  • Use a single repo to store multiple formats
  • Move packages between repos using promotion rules

Direct pulls from public registries leave you with no visibility into what's coming in. Proxy and cache every remote registry through Cloudsmith and apply policy before packages reach your teams.

  • Replace direct pulls from OSS registries with Cloudsmith
  • Apply policies and checks on OSS packages and ML models before they reach teams
  • Speed up your build times with Cloudsmith’s global availability

No visibility means a runaway process is already an incident by the time you see it. Cloudsmith logs every upload and pull, so you can see what's moving before it becomes a problem.

  • Complete client logs showing uploads, egress
  • Best in class web application designed for oversight
  • Log exports to feed into analysis projects and third-party tools
Keep going

Go deeper on fully-managed artifact management

Frequently asked questions

Answers on repositories, upstream caching, migration and day-to-day package management in Cloudsmith. Book a demo to get answers tailored to your setup.

  1. Yes. Migration tooling handles URL remapping and credential remediation, and a phased rollout keeps pipelines running while repositories move over. Most teams complete a full migration in months, not years.

  2. No. Every Cloudsmith repository is multi-format, so Maven artifacts, npm packages, Docker images, ML models and raw files can sit side by side in the same repository instead of one tool per format. That's one less axis of repository sprawl to manage.

  3. Yes. Connected repositories link multiple Cloudsmith repositories so packages from all of them resolve through a single endpoint, with no copying between teams. Packages are visible as soon as they are pushed, with no indexing delay, and you set a priority on each connection to decide which repository wins when the same package exists in more than one. Upstreams configured on connected repositories are inherited too. The feature is in early access and works between repositories in the same workspace.

  4. Cloudsmith proxies and caches upstream sources like npm, PyPI and Docker Hub directly inside a repository, so pipelines pull through one endpoint instead of hitting public registries directly. Cached dependencies stay available during upstream outages, and you get visibility into what your teams pull. There's no separate proxy service for you to deploy, patch or keep available.

  5. No. Cloudsmith is fully managed, globally available SaaS, so storage and throughput scale with usage automatically. Add repositories, teams or regions without sizing servers, planning capacity, or taking on more infrastructure to patch and maintain.

  6. Connected repositories are Cloudsmith's equivalent of virtual repositories. In JFrog's model, virtual repositories re-resolve metadata on every pull and are limited to a single package type each. Connected repositories are built on upstreams, so packages are available instantly and one URL serves every format.

  7. Yes. Cloudsmith includes a Docker registry where you push and pull images as you would with Docker Hub. You can also configure upstream Docker registries and cache the images your teams request, alongside every other format in the same workspace.

  8. Retention rules automatically delete packages that exceed a repository's configured limits for count, age or total size. That keeps your workspace tidy and storage costs down without manual cleanup.

  9. Yes. Custom domains can be account-wide, working across all repositories in your organization, or per-repository, for a single repository.

  10. Each repository has its own settings for access controls, upstream proxying, retention rules, Geo/IP rules, entitlement tokens, EULA enforcement, custom domains, webhooks, signing keys, license compliance and security scanning. Audit logs, client logs and usage statistics show you what happens inside it.

Get started with Cloudsmith