pypiserver

pypiserver is a free, open-source package index that you run yourself to distribute Python packages through familiar tooling. It is a strong fit for teams wanting a small, directory-backed private index, provided they are comfortable operating the service and its surrounding security controls. The main appeal is focused Python package delivery; the main caution is that it is not a full PyPI implementation or a broad artifact repository.

Overview

This project keeps package hosting deliberately narrow. It serves your own Python distributions from ordinary directories and exposes the PyPI-compatible interfaces needed by pip, easy_install, and search. That makes it practical when the requirement is simply “publish and install our packages” rather than a central system for many artifact types.

Because it is self-hosted, you control storage and deployment instead of relying on a hosted registry. You also take responsibility for updates, network exposure, authentication, backups, and capacity planning. The current series supports Python 3.10 and newer, plus PyPy3; older Python versions are untested and unsupported.

Key features

Directory-backed package serving

pypiserver recursively scans regular directories and serves wheels, source distributions, eggs, and accompanying PGP signatures. Existing filesystem workflows can therefore remain intact, and the format coverage handles common Python release artifacts without introducing a separate storage layer.

The default request-time scan is also its clearest scaling constraint. With thousands of packages, repeatedly walking the directory can noticeably slow responses. Directory caching can improve that behavior, but larger indexes should be planned with this limitation in mind.

Flexible publishing and access control

Packages can arrive through pip, setuptools, twine, pypi-uploader, or a direct scp copy. That range supports automated publishing pipelines as well as occasional administrative uploads. Uploads may be protected with an Apache htpasswd file, and API users can provide custom authentication callables. The maintainers strongly advise password-protecting uploads, so an exposed, unauthenticated publishing endpoint is a poor fit for private code.

Deployment and operations

The API returns a WSGI application that can run under a supported or user-selected WSGI server. Documented combinations include nginx, Apache, gunicorn, Paste, and other WSGI deployments. Official Docker images are published for main-branch pushes and development, alpha, beta, and final releases. Linux systemd instructions and Windows service guidance using NSSM broaden its deployment options.

pypiserver includes a default /health endpoint returning HTTP 200 when the service is up, with a configurable endpoint option. For encrypted connections, the documentation recommends placing it behind a reverse proxy that provides HTTPS. These pieces are useful for monitoring and production integration, but they still require you to assemble and maintain the surrounding infrastructure.

Important boundaries

The implementation covers only the PyPI API needed for easy_install, pip install, and search, not the complete PyPI API. It accepts documentation uploads but does not save those documents to disk. There is no upstream proxy and no container-artifact support, so teams seeking dependency caching, compliance workflows, or a mixed-language repository need another layer or another product.

Pricing

pypiserver — free. The open-source package server has no paid plans, free-trial period, seat charge, usage quota, or renewal term. The trade-off is operational rather than financial: hosting, securing, scaling, and supporting the installation remain your responsibility.

Platforms

pypiserver is self-hosted and listed for API, Linux, macOS, and Windows environments. Linux users can follow systemd service guidance; Windows operators can use NSSM service instructions. Docker images and WSGI deployment options provide additional ways to fit it into an existing environment.

Who it's for

Choose pypiserver if you need an inexpensive internal index for your own Python packages and already manage servers, reverse proxies, or containers. It suits small and midsize package collections where ordinary directories and standard Python clients are advantages, and where a narrow API is sufficient.

Look elsewhere if you need the full PyPI API, persistent package documentation, an upstream mirror, container artifacts, or a repository that scales without tuning directory access. The request-time scan and self-managed HTTPS and authentication are material considerations for large or tightly governed installations.

Pros and cons

• Pro: familiar Python tooling. pip, easy_install, twine, and related upload paths can use the index directly.
• Pro: straightforward storage. Recursive scans of ordinary directories make package files easy to place and manage.
• Pro: deployment flexibility. WSGI servers, Docker, nginx, Apache, gunicorn, Paste, systemd, and NSSM are documented options.
• Pro: useful operational hook. A configurable health endpoint supports basic service monitoring.
• Con: partial API. It does not implement the complete PyPI interface, limiting clients and workflows that expect broader functionality.
• Con: scaling work. Scanning the package directory for every request can slow service as collections grow, although caching can help.
• Con: documentation persistence gap. Uploaded documentation is accepted but not written to disk.
• Con: security is your job. Password protection and a reverse proxy for HTTPS are recommended rather than an all-in-one managed control plane.

Alternatives

For a wider comparison, see Package Registries and Artifact repository software.

• Inedo ProGet is the better direction when you want a freemium repository with unlimited feeds for private packages and Docker, plus a free trial, even though its free edition has limited security and compliance features.
• aptly suits users seeking a free CLI tool with an HTTP REST service for package management rather than a Python-focused index.
• npm is more appropriate for JavaScript package publishing, with a free public-package plan and paid options.
• Bioconductor is a free open-source choice for R and bioinformatics packages across web and self-hosted platforms.
• CPAN is aimed at Perl software and documentation distribution.
• LuaRocks targets Lua package management and module hosting.
• R-universe provides free public R package publishing through GitHub-backed registries.
• CocoaPods is the relevant free ecosystem for macOS and iOS libraries.

Verdict

pypiserver is a sensible recommendation for Python teams that want a free, self-hosted, low-overhead index and can handle authentication, HTTPS, and service operations themselves. Choose it for focused package distribution from familiar directories; choose another repository when you need complete PyPI behavior, durable documentation, upstream or container support, or easier scaling at large package counts.