Nora Runs a 15-Format Artifact Registry in One Container
· Tutorials
A MIT Rust registry that proxies and hosts Docker, npm, PyPI, Cargo and Maven from one binary with no database. Your private Artifactory. Buried Treasure No15.
Last updated: September 6, 2026 · 7-minute read
One container, no database, and fifteen package ecosystems behind a single URL. Nora is a Rust-built artifact registry — MIT licensed, 295 stars, first release this January — that does what JFrog's Artifactory and Sonatype's Nexus charge real money for: proxy-and-cache Docker, npm, PyPI, Cargo and Maven upstreams, host your private artifacts, and give every CI pipeline one predictable endpoint.
Buried Treasure №15, and the infrastructure-grade pick of this batch — the kind of project that reads boring in a sentence and indispensable after one week of flaky upstream registries. Every fact below comes from the repository, README, and its COMPAT compatibility matrix, verified September 6, 2026.
What the repo actually shows
The vitals: 295 stars, MIT license, Rust, created January 25, 2026, pushed to on the day of writing. Releases reached v1.2.2 on August 30 via v1.2.1, v1.2.0, v1.1.0 and v1.0.1 — a project that crossed its 1.0 line mid-year and keeps a steady patch rhythm. Nineteen open issues and 32 forks suggest real multi-user traffic rather than drive-by stargazing.
The quick start is the whole sales pitch: docker run -d -p 4000:4000 -v nora-data:/data getnora/nora:latest, open the UI, and the registry exists. A single binary path serves the same purpose on x8664 and ARM64 — the latter covering Raspberry Pi, Graviton and Apple Silicon VMs, which quietly makes Nora a one-board air-gapped registry.
The format matrix is the product
Fifteen formats sounds like marketing until you read the compatibility table, which is the most honest artifact in this series since LibreDB's documented limitations. Docker Registry v2, Maven, npm, Cargo, and PyPI get full hosted-and-proxy treatment — pull-through caching with sensible defaults pointing at Docker Hub, Maven Central, npmjs, crates.io and PyPI. Go modules run proxy-only, which is protocol-correct since the Go module proxy protocol has no push.
The partial rows are labeled with reasons rather than checkmarks: RubyGems, Terraform, Ansible Galaxy, NuGet and Dart's pub are proxy-only because publish protocols are not implemented in v1.x — the table says so per format, with a COMPAT.md tracking client-level quirks like Conan's. RPM and Debian/APT run hosted with auto-generated repodata and Packages indexes, and Helm rides the OCI endpoint. A matrix that names its gaps builds more trust than a feature list that hides them.
Why this earns a slot in 2026
Three forces converge here. First, CI economics: every npm install and docker pull re-downloaded across a team is bandwidth and minutes billed repeatedly — a pull-through cache pays for itself on a single mediocre week, and on Indian VPS pricing the whole thing costs less than the coffee budget, the same arithmetic that made SwiftWave's VPS story land with readers.
Second, supply-chain posture: pinning your builds to your own registry means an upstream outage, a yanked version, or a compromised package lands in your review queue instead of your pipeline. Nora's defaults lean secure — authentication required on all endpoints, anonymous read strictly opt-in — and raw-file hosting supports conditional requests with ETag validation per RFC 9530 digest verification, the kind of spec-literal detail that signals engineering seriousness.
Third, the air-gapped case is not exotic anymore. Defence contractors, banks and hospital-adjacent vendors increasingly build software in networks with no upstream access at all; a registry that runs on one ARM board with no database is the cheapest credible answer to that requirement, and it pairs naturally with the self-hosted infrastructure pattern this site documents for small teams.
The honest caveats
Three, as the series demands. First, publish coverage is the gap that matters most: if your workflow pushes heavily to RubyGems or NuGet, v1.x is proxy-only there — check the matrix against your actual push targets before migrating. Second, single-binary simplicity means single-process availability; run it behind systemd or a container supervisor, and take the volume backup seriously, because a registry is infrastructure your pipeline depends on, not a toy. Third, the series-standard transparency: verified from the repo and matrix, not load-tested by this site against a 500-developer estate — the README's own scaling framing starts at docker run and grows from there, which is the honest shape of the claim.
Who it is for, who should skip
Strong fit: small-to-mid teams tired of CI minutes burned on repeated downloads, shops standardizing a private Docker and Python path, homelab operators running a self-hosted stack who want their own mirror of the internet's package wells, and anyone with an air-gap requirement on a budget.
Skip it if you need federated multi-site replication, vulnerability scanning dashboards, or the audit surface of enterprise Artifactory — those are different products at different price points, and pretending otherwise helps nobody. Solo developers with one language can get by with each ecosystem's native cache; Nora's value scales with the number of ecosystems you touch.
Verdict
Nora is infrastructure in the best sense: unglamorous, precisely scoped, documented to the RFC, and priced at one container. The 295 stars reflect an audience that found it early; the compatibility matrix reflects a maintainer who intends to keep them. If your pipelines touch three or more package ecosystems, the docker run costs you forty seconds and will likely save its first week inside a month.
Next Buried Treasure, the final pick of this batch: the rarest project of the sixteen so far — a family operating system in one SQLite file.
---
Not affiliated with the Nora project. Facts verified from the GitHub repository, README and COMPAT matrix on September 6, 2026. More open-source discoveries in the Buried Treasure series.