[ Stash ]
A registry that runs
inside your zone.
Stash is a self-hosted OCI registry and package repository. One container, deployed next to your build fleet or inside an air-gapped site. Push private images, cache upstream registries locally, and keep production artefacts on infrastructure you own and audit.
$ docker run -d --name stash \ -p 5000:5000 \ -v stash-data:/var/stash \ onzr/stash:latest $ docker login localhost:5000 $ docker push localhost:5000/my-app:latest
+ macOS x86 · ARM · air-gapped
We have operated private clouds for other people for a long time. Every one of them eventually needed a registry, and the options were the same three bad ones: rent a public registry and push your private builds into someone else's estate, run a heavyweight platform that arrives with its own database, message queue and upgrade risk, or leave a bare open-source registry in a corner with nobody owning it.
So Stash. One container, inside your zone, with the controls an operator is asked for at audit time. Speaks plain OCI, so docker push, podman push, and helm push all just work. That's the whole pitch.
Built for the people running their own stuff.
Stash is built for data centre teams, service providers, and platform teams inside enterprises and SMBs - anywhere private images, charts, and packages have to stay on infrastructure you control.
For private cloud teams
The registry lives in the same zone as the workloads that pull from it. Deploy one per site, back it with local disk, NFS, or S3-compatible storage, and keep image pulls on the internal network where they belong.
- One container per site, that's the install
- Local disk, NFS/SMB share, or S3 backend
- x86 and ARM64 servers, bare metal or VM
- Runs under Foundry or your existing orchestrator
For CI/CD
Stop letting upstream registries rate-limit your build fleet. Stash runs as a pull-through cache so builds pull hot images locally, and pushes finished artefacts to a registry you control. No egress bills, no external dependency in the critical path.
- Pull-through cache for Docker Hub, GHCR, Quay
- Push tokens scoped per-repo
- GitHub Actions / Drone / Woodpecker / GitLab
- Retention rules: keep last N tags, GC the rest
For regulated & air-gapped estates
Defence, public sector, banking, and anyone whose auditor asks where the images came from. Stash runs behind your reverse proxy, on an isolated network, entirely inside the perimeter you control.
- Plays nice with Caddy, Traefik, nginx
- Nexus overlay, private VLAN, or LAN-only modes
- Runs fully inside your network perimeter
- Air-gapped / offline-first by design
For ISVs & service providers
Ship your product to customers as signed container images from a registry you operate. Per-customer namespaces, signed releases, and a one-line docker pull URL you control end to end - including into customer sites that never touch the public internet.
- Per-customer namespaces and scoped tokens
- Cosign signing & verification
- Helm charts, OCI artifacts, ORAS support
- Multi-arch manifests for amd64 + arm64
From zero to first docker push in about a minute.
No Helm chart. No Postgres. No "first, configure your secrets backend." Just a container.
# 1. Run it $ docker run -d --name stash \ -p 5000:5000 \ -v stash-data:/var/stash \ onzr/stash:latest # 2. Log in (default: admin / printed on first start) $ docker login localhost:5000 ✓ Login Succeeded # 3. Push something $ docker tag nginx:alpine localhost:5000/nginx:alpine $ docker push localhost:5000/nginx:alpine ✓ Pushed in 1.2s # 4. (optional) Helm $ helm push my-chart-0.1.0.tgz oci://localhost:5000/charts $ █
Run the container
One docker run. Storage is a named volume by default; point it at a NAS, an external drive, or S3 if you'd rather.
Log in
First-boot password is printed to the container logs. Swap it out for tokens later, or run in anonymous mode for a LAN-only setup.
Push & pull
Standard docker push, docker pull, helm push, ORAS, anything that speaks the OCI distribution spec.
Small, but not toy-grade.
The opinionated stuff a real registry needs, none of the enterprise heaviness.
Pull-through cache
Mirror Docker Hub, GHCR, Quay locally. CI pulls become instant after the first hit, and rate limits stop being your problem.
Content-addressed storage
Identical layers across images store once. Capacity stays flat as image counts grow, and rebuilds dedupe themselves automatically.
Online garbage collection
GC runs without stopping the registry. Set retention rules ("keep last 5 tags") and Stash quietly cleans up while you sleep.
Tokens, not seats
Per-repo push/pull tokens scoped exactly where you need them. Drop them into CI secrets and forget. No "user management."
Cosign-friendly
Sign your releases, verify signatures on pull. Works with the standard Sigstore / Cosign tooling. No proprietary signing format.
Mirror to a friend
Run two Stash instances and have them mirror each other. Useful for offsite backups, disaster recovery, or just keeping a copy at the parents' house.
Where Docker goes, Stash goes.
Want to try it on your box?
We onboard data centre teams, service providers, and platform teams one at a time, so every deployment gets an engineer who knows it. Tell us where it would run and we'll take it from there.
Sign-ups open soon. In the meantime, reach us at contact@onzr.cloud.