Bosca / Artifacts

Storage

Stored once, proven intact

Underneath every format sits one blob store, where a blob's digest is its identity. Uploads are hashed as they stream in, identical bytes are never written twice, and nothing survives that can't prove what it is.

Content-addressed

The digest is the identity

A blob's digest is both its database identity and its path in object storage — so deduplication isn't a feature layered on top, it's a consequence of the design.

  • Identical bytes are one object, however many versions or repositories reference them — a Docker base layer shared by twenty images is stored once.
  • References are counted: each version that points at a blob holds a reference, and deletes decrement it.
  • When the last reference goes, the blob becomes collectable — an atomic check-and-delete that stays correct under concurrent pushes.
  • Docker layers, npm tarballs, Maven jars, Helm charts, model archives — every format lands in the same store.
blob store
sha256:7d9c4f2a…84.2 MB3 refs
sha256:e3b0c442…12.7 MB1 ref
sha256:a1b0c7d4…4.1 MB0 refs → collectable

Verification

Nothing lands unchecked

The registry computes hashes while an upload streams, before anything is committed — a corrupt or mislabeled artifact is rejected at the door, not discovered at deploy time.

  • Docker uploads declare a digest; the registry verifies the assembled content against it and rejects mismatches.
  • Large layers stream in chunks, tracked as upload sessions with byte offsets and expiry.
  • Maven artifacts serve .sha1, .md5, and .sha256 checksum files; npm tarballs carry shasums and SRI integrity.
  • Digests follow uploads all the way through — the same hash that verified the push addresses the blob forever after.
PUT blob · ?digest=sha256:e3b0c442…
streamed  12.7 MB · sha256 computed
declared  e3b0c442…
computed  e3b0c442…
✓ match — blob stored

Bytes & metadata

Object storage below, PostgreSQL beside

The server keeps no artifact bytes on local disk, so instances carry no state of their own.

  • Artifact bytes live in S3-compatible object storage at digest-derived paths.
  • Namespaces, repositories, versions, tags, permissions, and upload sessions live in PostgreSQL.
  • The registry runs as a standalone service and compiles to a GraalVM native image.
  • Deleting a namespace or repository cascades — versions, tags, and blob references go with it, and blobs nothing references anymore are collected.
where things live
Bytes → object storage · artifacts/sha256:…
Metadata → PostgreSQL · versions, tags, grants
Server → GraalVM native image, no local state

Keep exploring

More on Artifacts

Artifacts overview

Six registry formats behind one namespace and permission model.

Registries

Docker, Helm, Maven, npm, ML models, and raw files — native protocols.

Access control

Public or private namespaces, group grants, and scoped registry tokens.

Platform integration

Publish events, CI requirement gates, ML model serving, and admin APIs.