Cloudsmith

Overview

Cloudsmith is a managed service for storing and distributing software artifacts, from packages and containers to raw files and ML models. It is strongest for teams that need shared repositories alongside supply-chain controls; organizations requiring a self-hosted registry should look elsewhere. Its global delivery network is a useful fit for distributing packages across regions, but plan quotas make the right tier important.

Key features

Repositories can hold multiple formats, and the Docker-compatible, OCI-compliant registry supports container artifacts. Cloudsmith supports 33 package formats, including Docker, Python, Maven, npm and Helm, as well as raw files of any type. That breadth suits teams managing varied build outputs in one service rather than separate format-specific stores.

Public upstream registries can be proxied and cached, while retention rules and fine-grained access controls help govern repositories. Security checks cover packages, containers and ML models for known vulnerabilities, malware and license violations. Teams can block items that fail policy and record what shipped where. Continuous risk detection, built-in CVE, license and malicious-package policies, configurable cooldowns, and OPA/Rego policy as code give security teams more control than storage alone.

Access governance includes team controls, service accounts, OpenID Connect, SAML SSO and groups, SCIM, and API-key policies. Developers can work through a CLI, REST API, language bindings for Go, Java, Python and Ruby, webhooks, or a VS Code extension. The standalone CLI runs on Linux, macOS and Windows, with Python, Homebrew and Docker installation options.

Cloudsmith says its delivery network serves packages from 600 points of presence, using edge caching and regional fault tolerance. It reports independent verification against ASVS 4.0 Level 2, ISO 27001:2022 certification, and encryption in transit and at rest. These are meaningful assurances for organizations with security requirements, though the service remains cloud-only.

Pricing

The Free Open-Source plan costs 0.00 USD per free and is limited to valid Open-Source licenses. It includes 50 GB of artifact data and 200 GB of package delivery, plus a public repository. Those generous stated quotas make it suitable for eligible open-source projects, but not a general private-repository free tier.

Pro costs 149.00 USD per month, billed monthly, for 5 GB of artifact data and 25 GB of package delivery; additional data costs $1.50/GB. It is the priced option for teams that need a paid plan, but those caps may be restrictive for high-volume registries. A free trial lasts 14 days.

Core has custom pricing, billed monthly, with 500 MB of artifact data and 1 GB of package delivery; additional data is N/A. Its small quotas make it a narrow fit for modest usage. Ultra and Enterprise use custom pricing and custom artifact, delivery and additional-data terms. Ultra adds Priority support and a standard uptime SLA; Enterprise adds Enterprise support and custom contract terms. Core and Pro have no support tier, so teams needing priority or enterprise support must move up.

The documented API baseline is 5,400 requests per hour for authenticated Core users and 50,000 requests per five minutes for Pro, Ultra and Enterprise users. That larger allowance can matter for automation-intensive teams. No seat allowance is stated in the plan terms.

Platforms

Cloudsmith is cloud-deployed and supports API, extension, Linux, macOS, web and Windows access. It integrates with AWS CodeBuild, Azure DevOps, Bitbucket Pipelines, CircleCI, GitHub Actions, GitLab CI/CD, Jenkins, Terraform Provider, webhooks and Slack. Support channels are email and documentation.

Who it's for

Cloudsmith suits organizations replacing on-premises registries, securing software supply chains, adopting AI artifacts, improving developer workflows or distributing packages globally. Its range of formats, policy controls and integrations can serve solo users through enterprise teams, but the free plan's license restriction and Pro's quotas make it less suitable for general-purpose use at no cost or for large volumes on a fixed low tier.

Pros and cons

• Pros: Broad format support and raw-file storage let teams consolidate varied artifacts; policy checks can block risky packages before distribution; upstream caching, retention rules and fine-grained controls support governed repositories; global delivery spans 600 points of presence.
• Cons: It cannot be self-hosted; the free plan is restricted to valid open-source projects; Pro's 5 GB artifact and 25 GB delivery allowances may constrain growing workloads; Core's 500 MB and 1 GB quotas are small, and Core and Pro have no support tier.

Alternatives

For a broader comparison, see Artifact repository software.

• Sonatype Nexus Repository is worth considering if self-hosting matters: its platform list includes self-hosted deployment, and its free Community Edition includes full ecosystem support, CI/CD integration and an external PostgreSQL database option.
• Buildkite may suit teams choosing a CI/CD service rather than an artifact repository: its free plan allows up to 5 users, 10 concurrent jobs, 2,000 Linux vCPU minutes per month and 250k test.
• Inedo ProGet is an alternative with a free edition offering unlimited feeds for private packages and Docker, though its free edition has limited security and compliance features.
• Packagecloud offers a free plan with 10 GB bandwidth, 2 GB storage and unlimited CI/CD minutes, or a Starter plan at 89.00 USD per month billed per month.
• Anaconda Notebooks is a freemium option with a free plan that includes 5 GB cloud storage.
• Artifact Keeper offers a free, MIT-licensed option with all features included and no per-user fees.
• Google Artifact Registry offers a free storage tier and regional and multi-regional repositories.
• Cachix is another freemium option, with a Starter plan that includes 50 GiB of storage and unlimited bandwidth.

Verdict

Choose Cloudsmith if you need a managed, multi-format artifact service that pairs global distribution with enforceable supply-chain policies. Its strongest case is bringing storage, caching, access governance and security checks into one cloud service. Look elsewhere if self-hosting is essential, if a general free private tier is required, or if Pro's stated quotas cannot accommodate your workload.