Remote repositories act as proxies for upstream sources, such as Docker Huband Maven Central, and provide more control over your dependencies inGoogle Cloud. This document describes how remote repositories work and providesseveral use cases.

For instructions on how to create a remote repository, seeCreate remote repositories.

Note: Artifact RegistryQuotas and limits apply to remote repositories.

How remote repositories work

Remote repositories store artifacts from standard Artifact Registry repositoriesand external sources. The first time that you request a version of a package,Artifact Registrydownloads and caches the package in the remote repository. The next time yourequest the same package version, Artifact Registry serves the cached copy.

If you request an artifact from an upstream source that doesn't exist, ordoesn't contain the version you specified, the request will fail.

Upstream authentication

Artifact Registry remote repositories supportbasic authentication to upstream sources for supportedformats. For more information on how to authenticate to remote repositoryupstream sources, seeConfigure authentication to remote repository upstreams.

Use cases and benefits

Faster, more reliable access to artifacts

Storing cached copies of your public dependencies in Artifact Registryreduces latency when other Google Cloud services retrieve images.Cached artifacts are also still available if the external public repositoryis offline due to an outage or other issue.

Safer dependency resolution

Use remote repositories together with virtual repositories to mitigate risksassociated with public dependencies. Some tools do not provide a way tocontrol search order when a mix of private and public repositories areconfigured in the client. This type of configuration is vulnerable to adependency confusion attack, where someone uploads a new version of apackage with bad code to a public repository to trick clients into choosingthe bad version.

Instead of configuring clients directly to search multiple repositories, youcan configure virtual repositories to prioritize your private repositoriesover remote repositories.

Reduce data transfer cost

Use remote repositories to cache artifacts in the same region or multi-regionas your runtimes to reducedata transfer costs.

If Artifact Registry is in aVPC Service Controls service perimeter,Artifact Registry denies access to upstream sources outside the perimeterby default. To allow remote repositories in a specific location to accesstheir configured external sources outside the perimeter, see the instructionsforVPC Service Controls configuration.

To learn about other dependency management best practices, seeDependency management.

Updates to package indexes and metadata

Mutable files such as package indexes and metadata are updatedfrom the upstream source when they become more than the default age. Defaultsfor specific file types are listed in the following table:

Format	File type	Default update age
Maven	maven-metadata.xml	5 minutes
	archetype-catalog.xml	1 hour
Npm	Manifest files	5 minutes
Python	Index files	1 hour
Docker	List/Get tags cache	1 hour
Apt/Yum (preview)	Index files	2 minutes
	Package files	72 hours

Supported formats

See the following sections for the formats available for preset and user-definedremote repositories.

Preset upstream URLs

A number of common upstream repository URLs are available as preset selectionsfor convenience in the following formats.

Format	package types	Upstream URL	Upstream preset name
Docker	Public or private	https://registry-1.docker.io	DOCKER-HUB
Go	Public	https://proxy.golang.org	https://proxy.golang.org
Maven	Public or private	https://repo.maven.apache.org/maven2	MAVEN-CENTRAL
npm	Public or private	https://registry.npmjs.org	NPMJS
Python	Public	https://pypi.io	PYPI
OS packages (preview)	Public	SeeOS packages supported upstreams	SeeOS packages supported upstreams

OS packages preset upstreams

Preview

This product or feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of theService Specific Terms. Pre-GA products and features are available "as is" and might have limited support. For more information, see thelaunch stage descriptions.

You can create an OS package remote repository by choosing from one of thecommon preset upstream repository base URLs and customizing the remainder of theURL to the specific repository. The following repository bases are supported:

Apt

Repository	URL Prefix	Repository Base Name
Archived Debian	https://snapshot.debian.org	DEBIAN_SNAPSHOT
Debian	http://deb.debian.org	DEBIAN
Ubuntu LTS or Pro	http://archive.ubuntu.com	UBUNTU

Yum

Repository	URL Prefix	Repository BaseName
CentOS	http://mirror.centos.org	CENTOS
	http://debuginfo.centos.org	CENTOS_DEBUG
	https://vault.centos.org	CENTOS_VAULT
	https://mirror.stream.centos.org	CENTOS_STREAM
Rocky	http://dl.rockylinux.org	ROCKY
Fedora Extra Packagesfor Enterprise Linux(EPEL)	https://dl.fedoraproject.org/pub/epel	EPEL

Artifact Registry repository upstreams

You can create remote repositories with Artifact Registry standard formatrepositories as upstreams for the following formats:

• Docker
• npm
• Maven
• Python

Custom URLs

You can enter the URL for your remote repository directly, without using one ofthe preset upstream sources for the following formats.

• Docker
• npm
• Maven
• Python

The following non-exhaustive table lists some common upstream URIs.

Format	Upstream URI	Registry Name
Docker	https://ghcr.io	GitHub Container Registry
Docker	https://registry-1.docker.io	Docker Hub
Docker	https://public.ecr.aws	AWS ECR Public Gallery
Docker	https://registry.k8s.io	Kubernetes Container Registry
Docker	https://MY_NEXUS_IP	Nexus
npm	https://registry.npmjs.org	npm
npm	https://npm.pkg.github.com	GitHub Npm Registry
npm	https://MY_NEXUS_IP/repository/MY_UPSTREAM_REPOSITORY	Nexus
Maven	https://repo.maven.apache.org/maven2	Maven Central
Maven	https://MY_NEXUS_IP/repository/MY_UPSTREAM_REPOSITORY	Nexus
Python	https://pypi.io	Python Package Index (PyPI)
Python	https://MY_NEXUS_IP/repository/MY_UPSTREAM_REPOSITORY	Nexus

Where

• MY_NEXUS_IP is the IP address and port of your Nexus upstreaminstance.
• MY_UPSTREAM_REPOSITORY is the name of your upstream repository;used in the Nexus examples.

Limitations

In addition to Artifact Registry quotas and limitations, remoterepositories have the following limitations:

• Maven remote repositories don't permit setting the version policy to snapshotor release.
• Upstream sources must be internet accessible. Remote repositories don'tsupport on-premise or Virtual Private Cloud (VPC) network upstream sourceswithout a public IP address.

Other repository modes

The other repository modes are:

• Standard: The default repository mode. You upload or publishartifacts such as private packages directly to standard repositories.Although you can download directly from individual standard repositories,accessing groups of repositories with a virtual repository simplifiestool configuration.
• Virtual: A repository that acts as a single accesspoint for multiple upstream repositories, including remote and standardrepositories.

What's next

• Create remote repositories.
• Learn more about Artifact Registry repositories by reading theRepository overview.