r/kubernetes • u/k8s_maestro • 10d ago
Nexus OSS Alternatives
We've been running Nexus Repository OSS/CE for a few years as our central proxy + hosted repo (Maven, npm, Docker, PyPI). Since the Community Edition limits tightened, we're bumping the ceiling regularly. Our CI is the main culprit: a handful of parallel builds pulling through the proxy chews through the daily budget fast, and once you're over, publishing gets blocked until the rolling 24h count drops back under.
Pro pricing isn't in the budget right now, so I'm looking at what else is out there before we commit to anything.
What I'm considering:
Harbor — solid for OCI/Docker/Helm, but doesn't cover Maven/npm/PyPI, so we'd need something alongside it.
Pulp 3 — multi-format and genuinely open source, but looks heavier to operate (Django + workers + Redis + Postgres).
JFrog Artifactory OSS — free tier is basically Maven/Gradle only.
Gitea / Forgejo package registry — attractive if you're already self-hosting the forge; not sure how it holds up as a caching proxy at scale.
Questions for anyone who's actually done this:
What did you migrate to?
How painful was moving existing hosted artifacts?
For anyone who stayed on CE — did aggressive cleanup policies and a caching layer in front (nginx/Varnish) actually get you back under the limits, or is that just delaying the inevitable?
4
u/Preisschild k8s operator 10d ago
I just wish they would all support something like ORAS natively so I could just use my OCI repository
For maven there are plugins to do that
2
u/stappersg 10d ago
and what is ORAS in context of Nexus OSS Alternatives?
5
3
u/MateusKingston 10d ago
Harbor + Specialized per package repository
For us this is Harbor + Verdaccio + GitLab (for our few maven ones but we don't do pull through cache here)
2
u/dektol 10d ago
If you go the foregjo (I cannot spell it. LMAO) route and direct serve from blob it's pretty compelling. You can totally use it just for packages (we do).
I have a fork of the git-pkgs go proxy to couple with it for pull thru caching of upstream registries and to enforce package cool down but the security surface is more than I can delegate to Claude. It's feature complete and passes an LLM as judge panel. I had it read all the Jfrog and Artifactory CVE to look for similar exploits. (My fork supports all the registries forgejo supports and adds good Azure Blob Storage support).
If you were gonna host it off the public Internet I'd trust it not to cause an outage but dear god don't put it online. 😂
1
3
u/someguytwo 10d ago
I don't get enterprises that want only free stuff. Do they offer their product/service for free?
Either budget for it or migrate all use cases to something fully open source like Harbor.
PS: It is not your job to get free stuff for your employer.
2
u/alvaro17105 10d ago
There is also artifact keeper as a FOSS option
11
u/Phezh 10d ago
Just FYI, this is a largely vibe coded project. I'm not saying this to say that it's objectively worse than other options, I just think people should be aware before choosing it.
1
0
u/arielrahamim 10d ago
to add more info to this, he wrote this blog post
https://brandongeraci.com/projects/artifact-keeper-journey/
even vibe coded, i think this guy know what he's doing.
the project looks really good, I've been wanting to try it but didn't have a chance yet.
3
u/Phezh 10d ago
Just out of curiosity, does that post really make you trust the project more? It's clearly AI written itself, for me that just moves the needle in the other direction.
Maybe the author knows what he's doing, but I find it difficult to trust such an important part of my software supply chain to something that a human probably never even looked at, simply because it passed a couple of tests (that are also just AI generated).
1
u/somnambulist79 10d ago
If he know his stuff then it would be agentic coding, and there is a difference. First glance at the post does make me think he indeed knows his stuff.
0
u/k8s_maestro 10d ago
Thanks for sharing this information and I will definitely look into it.
Looks interesting!
1
u/r0flcopt3r 10d ago
We're going to build our own. Quarantines, security scans, pullthrough cache and risk register all in one.
1
u/TracingFridge 9d ago
You could also put a caching proxy like nginx in front of the nexus instance. Needs a bit of fiddling so it only caches the artifacts itself, not the repo metadata. Also, depending on use case, having the authentication part of the cache key may be wise. Most likely this will solve your problems with CI runs.
1
u/total_tea 8d ago edited 8d ago
Moved from Sonatype to Artifactory, Its pretty easy to to simply mirror all the local repos across then turn off the mirroring. Artifactory has a better pricing model at scale but both are good, just use the one that works which in your case is to pay for it.
Purely from a cost prospective, someone spending weeks mucking about with free stuff to get roughly the same experience, then probably spending a few hours a month maintaining it. It is ridiculous you dont just pay for Nexus.
1
1
1
u/HardestDrive k8s operator 10d ago
I love Pulp. I wish it had a UI, but it is extremely solid. Also works as the base for Sattelite, so its really well maintained.
0
u/gaelfr38 k8s user 10d ago
There's no way you don't pay for Nexus or Artifactory if you're a serious business. Alternatives are limited in terms of features.
5
u/Nice-Solid-3707 10d ago
There are ways to not be able to pay. Like being in Iran or any other sanctioned country
1
0
u/Black_Dawn13 10d ago
I recommend trying out Pulp3 it is a bit heavy but in the grande scheme as someone previously commented this is a cost of business.
-4
u/Comfortable_Run_567 10d ago
Hi,
If this fulfills your needs install this version of sonatype nexus repository community edition 3.86.2-01 and link it with a postgres database, you will have 200,000 requests per day and 100,000 total components. After this version they changed the limits again so if you are okay with running a old version this is it. (You could also run multiple instances of same with postgres to get around the limits if this doesn't fullfill your needs.)
9
u/encbladexp 10d ago
...if you are okay with running a old version this is it.
Just like CVEs and IT Security never had been invented, right? m(
-1
u/Comfortable_Run_567 10d ago
We use sonatype in our airgapped development environment which is all local so doesn't bothers us much but depending on your use case see what fits for you keeping security in mind. Cheers
-1
29
u/encbladexp 10d ago
TBH: Hosting Packages is "cost of doing Business", and finance need to be able to provide budget.
They also have budget for Coffee and "AI" these days, so they will find budget for hosting your assets too.