Skip to content

Repod — Enterprise Linux Package Repository Manager

Your private artifact platform. Secured by design.

Ship .deb, .rpm, .apk, Maven, PyPI, npm packages, and container images to your infrastructure from a single backend with a full security pipeline — antivirus scanning, CVE analysis, GPG signing, SBOM generation, and an immutable audit trail. NIS2 and SecNumCloud ready. Every format, one security pipeline.

Get started in 5 minutes Why Repod?

What Repod does

  • Security pipeline, built-in

    Every package goes through 6 automated checks: format validation, SHA-256 provenance, antivirus scan (ClamAV), CVE analysis with EPSS + CISA KEV enrichment, GPG signature, and dependency resolution. No package reaches production without passing.

  • Every format, one platform

    Manage Debian/Ubuntu (.deb), RedHat-family (.rpm), Alpine (.apk), Maven, PyPI, npm packages, and OCI container images from the same web UI, the same REST API, the same PostgreSQL database, and the same security pipeline. A single environment variable (REPO_FORMAT) selects which OS-package formats an instance serves.

  • Native protocol support

    apt install, dnf install, apk add, mvn deploy, pip install / twine upload, npm publish, and docker push / docker pull all work against Repod exactly as they would against the public registries — no custom client, no plugin.

  • Role-based access control

    Five roles — reader, uploader, maintainer, auditor, admin — with a surgical permission matrix, plus optional per-distribution and per-machine access restrictions for larger fleets. Your CI/CD pipelines get uploader, your CISO gets auditor. No over-provisioning.

  • SBOM & compliance

    Generate Software Bills of Materials in CycloneDX 1.5 and SPDX 2.3 for every package or your entire repository. CIS/STIG configuration compliance scanning and configuration drift detection across your fleet. NIS2 article 21, ANSSI SecNumCloud, and GDPR alignment built-in.

  • Immutable audit trail

    Every action — upload, delete, CVE decision, login, config change — is logged to append-only JSONL files. 19+ event types. SIEM-ready export. Nothing is ever rewritten.

  • CISO review queue

    Critical CVEs don't just block — they enter a review queue. Your security team sees CVSS score, EPSS probability, and CISA KEV status before approving or rejecting. Every decision is justified and logged.

  • Fleet inventory & remote install

    SSH-based inventory of the machines that consume your packages: installed versions, exposed CVEs, and governed remote install jobs with mandatory dry-run — all from the same web UI.

  • Built to stay up

    Active/passive high availability across multiple replicas, an air-gapped upstream cache for bandwidth-limited or disconnected sites, and self-verifying scheduled backups.

One backend, every format

Repod is a single application: one FastAPI backend, one PostgreSQL database, one React web UI, and one security pipeline. The REPO_FORMAT environment variable controls which OS-package format(s) an instance manages — there is no separate "APT edition" or "RPM edition" to choose between at install time.

REPO_FORMAT Package formats served Repository tooling
apt (default) .deb reprepro
rpm .rpm createrepo_c
apk .apk (Alpine) abuild-keygen + apk index
both .deb + .rpm reprepro + createrepo_c
all .deb + .rpm + .apk reprepro + createrepo_c + apk index
Format Supported distributions Client install
APT Debian 12 (bookworm) · Ubuntu 20.04/22.04/24.04 (focal/jammy/noble) apt install
RPM AlmaLinux 8/9 · Rocky Linux 8/9 · CentOS Stream 9 · Oracle Linux 8 · Fedora · openSUSE Leap 15.6 / Tumbleweed dnf install / zypper install
APK Alpine Linux 3.18 – 3.21 apk add

Maven, PyPI, npm, and the OCI container registry run alongside whichever REPO_FORMAT you've selected — they're independent subsystems, always available, each speaking the real upstream protocol (mvn deploy, twine upload/pip install, npm publish, docker push/pull) and running through the same antivirus, CVE, and review-queue pipeline as your OS packages. See Client Setup and Container Registry for configuration.

The bundled docker-compose.yaml runs REPO_FORMAT=all by default, starting one Nginx container for APT + APK (depot-apt) and one for RPM (depot-rpm), both fed by the same backend and PostgreSQL database. A self-contained REPO_FORMAT=rpm stack with its own database is also available — see Production Deployment.

Up and running in 60 seconds

git clone https://github.com/getautoflow/repod && cd repod
cp .env.example .env
cp backend.env.example backend.env
# Set JWT_SECRET_KEY, SETTINGS_ENCRYPTION_KEY, WEBHOOK_SECRET in backend.env
# (and POSTGRES_PASSWORD if you change the default)
docker compose up -d

Open http://localhost:3003 and create the admin account via the setup wizard.

Full installation guide →

Who uses Repod

  • DevOps teams

    Replace ad-hoc package installation workflows with a governed, auditable repository. Integrate with GitLab CI, GitHub Actions, Ansible, or any HTTP client.

  • Security teams (CISO/RSSI)

    Get full visibility into every package entering your infrastructure. Review CVEs before they reach production. Export SBOM for compliance audits.

  • Regulated industries

    Banks, healthcare providers, defense contractors, and public sector organizations use Repod to meet NIS2 supply-chain security requirements without cloud dependencies.

Repod vs. the alternatives

Repod Nexus OSS Artifactory CE Cloudsmith
APT + RPM + APK + Maven/PyPI/npm + OCI ✅ ✅ ✅ ✅
Built-in CVE scanning (every format) ✅ ❌ ❌ ✅ (paid)
CISO review queue ✅ ❌ ❌ ❌
SBOM (CycloneDX + SPDX) ✅ ❌ ❌ ✅ (paid)
Immutable audit trail ✅ Partial Partial ✅
CIS/STIG + drift detection ✅ ❌ ❌ ❌
NIS2 compliance dossier ✅ ❌ ❌ ❌
SSH fleet inventory & remote install ✅ ❌ ❌ ❌
High availability ✅ ✅ (paid) ✅ (paid) N/A (managed)
Air-gap / on-premise ✅ ✅ ✅ ❌
Open source (AGPL-3.0) ✅ ✅ ❌ ❌
No telemetry ✅ ✅ ✅ ❌

Full comparison →

Documentation