Artifact Keeper
A free, self-hosted warehouse for every kind of build output your team produces — npm packages, Docker images, Maven jars, and 40+ other formats — built as a drop-in, no-license-fee replacement for JFrog Artifactory or Sonatype Nexus.
🔗 Visit Artifact Keeper
Description
Every software team eventually needs a central place to store the things their builds produce — npm packages, Docker images, Python wheels, Helm charts — rather than scattering them across ad-hoc S3 buckets or public registries. JFrog Artifactory and Sonatype Nexus built businesses around being that warehouse, with enterprise licensing to match. Artifact Keeper aims to be the same warehouse, run on your own servers, without the enterprise price tag — like the difference between renting a storage unit indefinitely and just building your own.
Artifact Keeper is an open-source (MIT) universal artifact registry built in Rust with a PostgreSQL backend, supporting 45+ package formats (Maven, npm, Docker, PyPI, NuGet, Cargo, Helm, and more). It includes dual vulnerability scanning (Trivy and Grype), SHA-256 content-addressed deduplication, full-text search via OpenSearch, broad authentication support (JWT, OIDC, LDAP, SAML 2.0), fine-grained RBAC, GPG/RSA artifact signing, a WASM plugin system for extensibility, and peer-to-peer replication for distributed setups. It ships migration tooling specifically for teams moving off Artifactory, deploys via Kubernetes/Helm, Docker Compose, Windows Server, or AWS, and includes hardened base images (DISA STIG-approved) with over 6,400 unit tests.
💬 Our review
The short version: Artifact Keeper is making a direct, specific pitch — 'everything Artifactory does, free, with a migration path to prove it' — and on paper the feature list backs that up; the catch is it's still a young project asking you to trust it with something as operationally critical as your artifact registry.
What's notable here is the ambition of the feature parity: security scanning with two engines instead of one, SAML/OIDC/LDAP auth, fine-grained RBAC, and artifact signing are the kind of enterprise checkboxes that usually gate you into a paid Artifactory tier — Artifact Keeper claims 'zero feature gates.' The explicit Artifactory migration tooling signals exactly who this is built for: teams currently paying JFrog and looking for an exit.
The honest limits: at 965 stars, it's promising but nowhere near Artifactory's decade-plus of production hardening across thousands of enterprises, and 'zero feature gates' from a young project is a claim worth testing yourself rather than taking at face value — pilot it with non-critical artifacts before migrating your whole pipeline. If your build pipeline breaks the moment the registry is unreachable (most do), that's real production risk to weigh against the license-fee savings. For teams specifically motivated to leave Artifactory's pricing and comfortable running self-hosted infrastructure, it's worth a serious trial; for anyone risk-averse about registry uptime, Harbor (more established, though narrower in format support, mainly container-focused) or sticking with Artifactory/Nexus remain the safer defaults for now.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Open source (licence MIT), gratuit, aucune fonctionnalité verrouillée derrière un palier payant. Auto-hébergé (Kubernetes/Helm, Docker Compose, Windows Server, AWS).
Pros
Gratuit et open source (MIT) — pas de fonctionnalité verrouillée, contrairement aux paliers payants d'Artifactory/Nexus
Supporte 45+ formats de paquets (Maven, npm, Docker, PyPI, NuGet, Cargo, Helm...)
Scan de vulnérabilités double moteur (Trivy + Grype), signature GPG/RSA, RBAC fin, SSO (OIDC/SAML/LDAP)
Outils de migration dédiés depuis Artifactory
Cons
Projet jeune (965 étoiles GitHub) comparé à des décennies de production chez Artifactory/Nexus
La promesse « zéro fonctionnalité verrouillée » mérite d'être testée en pilote avant migration complète
Un registre d'artefacts est un point critique du pipeline CI/CD — risque de production à évaluer sérieusement avant d'y migrer entièrement