Silo

Self-hosted package registry for RPM, Alpine APK, npm, pacman (Arch Linux), and Debian (apt). Publish over gRPC; dnf, apk, npm, pacman and apt consume the results as real repositories over plain HTTP. Packages live in S3-compatible object storage, everything else lives in Postgres. A repo/channel can also pull through one or more upstream registries per format, optionally caching what it fetches, so it doubles as a local mirror in front of the public registries.

Why

GitLab's native RPM registry needs a paid tier. Pulp is heavier than this needs. Nexus dropped real yum/rpm support from its open-source line. Silo is a small alternative that keeps no local state, so replicas are interchangeable and horizontal scaling is just replicaCount.

Quickstart

docker compose up -d
docker compose logs silo | grep -A 12 'SILO BOOTSTRAP'

That brings up Silo, Postgres, and SeaweedFS. On the first start against an empty database, Silo mints an admin token and an admin user and prints them once — they're stored only as hashes.

silo login --server http://localhost:8080
silo publish ./my-package-1.0.0-1.x86_64.rpm --repo myrepo --channel stable
silo publish ./hello-1.0-r0.apk             --repo myrepo --channel edge
silo publish ./widget-1.0.0.tgz             --repo myrepo --channel stable
silo publish ./hello-1.0-1-x86_64.pkg.tar.zst --repo myrepo --channel arch
silo publish ./hello_1.0-1_amd64.deb        --repo myrepo --channel stable
silo list --repo myrepo --channel stable

The format is inferred from the file extension; pass --format to be explicit.

Publishing from CI

Any repository can publish to a silo instance with the reusable action in this repo — it installs the matching silo CLI release and runs publish, so callers don't hand-roll that themselves:

- uses: BirknerAlex/silo/.github/actions/publish@main
  with:
    server: https://silo.example.com
    token: ${{ secrets.SILO_TOKEN }}
    repo: myrepo
    channel: stable
    files: dist/*.tgz

files accepts multiple globs, one per line. Pin to a tag (e.g. @v0.10.0) instead of @main for a stable, reviewable dependency.

Documentation

The wiki has the full docs:

• Introduction — architecture, the format seam, distributed locking
• Installation — installing the silo CLI itself: deb/rpm/apk/pacman, Homebrew, or the GitHub release
• Setup — Docker Compose and Helm deployment, the config.yaml schema
• Usage — tokens, repo public/private mode, administration
  • RPM, APK, npm, pacman, Deb — per-client config, with and without auth, signing
• Maintenance — background jobs and retention-based package pruning
• Contributing — dev container, local builds, CI checks

Contributing

Contributions are welcome from anyone — bug fixes, docs, and new package formats alike. RPM, APK, npm, pacman, and Deb all hang off the same PackageFormat seam, so adding another one is additive, not a rewrite. See Contributing for the dev container, local builds, and the checks CI runs.

License

MIT