Vulnerability scanning
Every artifact is checked against OSV as it's pushed, so known CVEs surface before they reach a build.
Self-hosted · one Rust binary
Stop gluing registries together.
FerroBox is a single self-hosted binary for Cargo, npm, PyPI, OCI/Docker, Helm, Conan, Maven, NuGet, Go, and generic artifacts — with vulnerability scanning, SBOMs, and signing built in, not bolted on.
One binary
Deploy a single Rust binary instead of a pile of separate registry apps.
One login
SSO and RBAC apply across every ecosystem — no per-tool credentials to juggle.
Security built in
Vulnerability scanning, SBOMs, and signing ship with the binary, not bolted on after.
One binary. Ten ecosystems. No exceptions.
- Cargo
- npm
- PyPI
- OCI / Docker
- Helm
- Conan
- Maven
- NuGet
- Go
- Generic
Everything you'd otherwise need three tools for
Supply-chain security and registry ops that usually mean bolting on separate scanners, signers, and policy engines — built into the binary you already run.
Automatic SBOMs
A CycloneDX SBOM is generated for every artifact automatically — no separate pipeline step to remember or maintain.
License scanning
Flag incompatible or risky licenses in your dependency tree before they end up in a shipped artifact.
Sign & verify with Cosign
Artifacts are signed on the way in and verifiable on the way out — supply-chain integrity without extra tooling.
Admission policies
Block downloads or promotions outright when an artifact fails a CVE severity threshold or a license rule.
Forge, Mirror & Alloy repos
Host your own artifacts (Forge), pull-through cache upstreams (Mirror), or aggregate several repos behind one virtual endpoint (Alloy).
Replication
Keep multiple FerroBox instances in sync across sites or regions for redundancy and locality.
SSO, RBAC & robot tokens
OIDC single sign-on for people, fine-grained roles per repo, and scoped robot tokens for CI — no shared admin credentials.
WORM lock, quotas & retention
Make releases immutable, cap storage per repo, and let garbage collection clean up what your retention rules don't need anymore.
Plus webhooks and a full audit trail for everything that happens in the registry.
See it in action
Real screenshots are on the way — these are layout sketches so you can picture the shape of the UI in the meantime.
Repository browser
Preview — real screenshot coming soon
Vulnerability scan results
Preview — real screenshot coming soon
Admission policy editor
Preview — real screenshot coming soon
Quickstart
FerroBox ships as a container image and a Helm chart forv0.1.0.
Docker
docker pull ghcr.io/ferrobox/ferrobox:0.1.0Helm
helm install ferrobox oci://ghcr.io/ferrobox/charts/ferrobox --version 0.1.0Full configuration reference (Postgres, S3-compatible storage, OIDC, admission policies, and more) lives in theproduct README.
Stop stitching registries together.
Clone it, self-host it, and see how far one binary gets you.
GitHubSource, issues & releasesSponsorsBack the project on GitHub Sponsors
Commercial licenseComing soon, via Polar
FerroBox is source-available under the Functional Source License 1.1, Apache 2.0 Future License (FSL-1.1-Apache-2.0) — free for internal use, and each release becomes Apache-2.0 two years after it ships.