Freedom251 › Artifact repository software

kkRepo

Free plan LinuxSelf-hostedWeb

What kkRepo is

kkRepo is a free, Apache License 2.0, open-source artifact repository that runs on Linux, the web, and self-hosted infrastructure. It handles more than 20 package formats, including Maven, npm, PyPI, Docker/OCI, NuGet, Cargo/Rust, Terraform, and Hugging Face Models. Depending on the format, repositories can be hosted, proxy, or group repositories. A one-click migration flow can move repositories from Sonatype Nexus while preserving repository domains and URLs. Security scanning can generate CycloneDX SBOMs, match known vulnerabilities, manage policies and waivers, and optionally enforce download rules. Authentication supports Local, LDAP, and OIDC, with configurable anonymous access and fine-grained permissions. Blob storage can use OSS, S3, or files; metadata uses MySQL or PostgreSQL. Multi-replica deployments, Prometheus metrics, and Grafana dashboards support larger installations. Release 1.3.1 includes Java 25 JVM archives, Linux amd64 and arm64 native archives, and container images for both architectures.

Who it suits

kkRepo suits teams that need a self-hosted repository for many package formats, Nexus migration, security controls, or multi-replica operation. It is aimed at deployments where scalability, stability, or package volume matters.

What it does well

Supports more than 20 package formats
One-click Nexus migration preserves repository URLs
Security scanning includes SBOM generation
Local, LDAP, and OIDC authentication
Prometheus metrics and Grafana dashboards

What to know first

JVM archives require Java 25
Metadata requires MySQL or PostgreSQL
Availability of repository types varies by format
Self-hosted operation requires deployment management

Verdict

kkRepo combines broad package-format coverage with self-hosted control, Nexus migration, security scanning, and observability. It is a strong fit when your repository needs extend beyond a single format or basic storage.

Facts from kkRepo's own pages

Access control: Authentication options include Local, LDAP, and OIDC, with configurable anonymous access and fine-grained permissions. · github.com, 11 Oct 2026
Access controls: Authentication options include Local, LDAP, and OIDC, with configurable anonymous access and fine-grained permissions. · github.com, 11 Oct 2026
Artifact security: Artifact scanning can generate CycloneDX SBOMs, match known vulnerabilities, manage policies and waivers, and optionally enforce download rules. · github.com, 11 Oct 2026
Deployment and storage: The service supports MySQL or PostgreSQL metadata backends and OSS/S3 or File blob storage. · github.com, 11 Oct 2026
Deployment downloads: Release 1.3.1 provides JVM archives requiring Java 25, native archives for Linux amd64 and arm64, and container images for both architectures. · github.com, 11 Oct 2026
Deployment packages: The deployment guide documents Docker images and JVM and Native archive packages; the published Native images support Linux amd64 and arm64. · github.com, 11 Oct 2026
High availability: The project supports multi-replica deployments. · github.com, 11 Oct 2026
Integrations: The README lists Prometheus metrics export and Grafana dashboards for observability. · github.com, 11 Oct 2026
Intended use: The project says it is designed for deployments where stability, scalability, multi-replica operation, or management of a large number of packages matters. · github.com, 11 Oct 2026
Intended users: The README says kkRepo is designed for deployments where stability, scalability, multi-replica deployment, or management of many packages matters. · github.com, 11 Oct 2026
Maker: The GitHub profile identifies the project maintainer as KL (klboke) and lists Shanghai, China. · github.com, 11 Oct 2026
Nexus migration: It supports migration from Sonatype Nexus, including a one-click migration flow and preservation of repository domains and URLs. · github.com, 11 Oct 2026
Observability: It exports Prometheus metrics and provides Grafana dashboards. · github.com, 11 Oct 2026
Open-source license: kkRepo is released under the Apache License 2.0. · github.com, 11 Oct 2026
Package formats: The README lists support for more than 20 artifact formats, including Maven, npm, PyPI, Docker/OCI, NuGet, Terraform, and Hugging Face Models. · github.com, 11 Oct 2026
Product: kkRepo is a community-driven, fully open-source, self-hosted artifact repository. · github.com, 11 Oct 2026
Purpose: kkRepo is a community-driven, open-source, self-hosted artifact repository designed to address limitations of Sonatype Nexus Community Edition. · github.com, 11 Oct 2026
Repository types: Supported formats can use hosted, proxy, and group repository types, with availability varying by format. · github.com, 11 Oct 2026
Security reporting: The security policy asks users to report exploitable vulnerabilities privately through GitHub Security Advisories; security fixes target the latest main branch unless a release branch is announced. · github.com, 11 Oct 2026
Security scanning: Artifact scanning includes CycloneDX SBOM generation, known-vulnerability matching, policy and waiver management, and optional download enforcement. · github.com, 11 Oct 2026
Storage and databases: Artifact blobs can use OSS, S3, or file storage, while metadata and shared runtime state use MySQL or PostgreSQL; MySQL is the default. · github.com, 11 Oct 2026
Support: The README directs users to a Telegram group for community support and usage discussion. · github.com, 11 Oct 2026
Supported formats: It supports more than 20 package formats, including Maven, npm, PyPI, Docker/OCI, NuGet, Cargo/Rust, and Hugging Face Models. · github.com, 11 Oct 2026

Where kkRepo stands on Freedom251

Artifact repository software#45 of 64