pip, apt, npm, cargo, Go, Maven, Docker and more — Depsilo proxies and caches them all with built-in security scanning. Deploy once on your LAN, and every machine on your team gets local-disk speed installs.
All 13 package managers are production-ready today. pip, apt, npm, cargo, Go, Maven, RubyGems, Composer, NuGet, Conda, CRAN, Helm, and Docker — unified config, one binary, one dashboard.
All ecosystems share the same cache engine, storage backend, and web UI. Adding a new one is a plugin, not a rewrite.
100 concurrent CI jobs requesting the same package? Only one upstream fetch happens. Everyone else waits and gets served the moment it lands in cache. No thundering herd, no wasted bandwidth.
Configure tuna, aliyun, and pypi.org in priority order. Automatic health checks and latency-based fallback. Need a proxy for one upstream but not others? Set it per-source, not globally.
Start with local filesystem, zero config. When your cache outgrows a single machine or you want shared storage across nodes, switch to any S3-compatible backend with one line in config.toml. No data migration needed.
Hit rate, top packages, upstream latency, storage usage — visible without any extra setup. Prometheus endpoint at /metrics plugs into your existing Grafana dashboards in minutes.
Every cached package is automatically checked against OSV.dev for known CVEs. See vulnerability reports in your dashboard, get suggested block rules, and auto-block packages exceeding your CVSS threshold. Pro feature.
Create projects, track which packages each project uses, and export a standards-compliant Software Bill of Materials. SPDX 2.3 and CycloneDX 1.5 formats, ready for compliance reviews and audits. Pro feature.
We get asked this a lot. Here's the honest answer.
| DIY Nginx cache | Depsilo Recommended | |
|---|---|---|
| PyPI URL rewriting | Manual regex rewriting required — easy to get wrong, breaks on edge cases | Automatic. pip always downloads through your cache, zero config per client beyond index-url |
| APT GPG signatures | Must MITM the connection or signatures break, security risk | Full passthrough. apt verify works exactly as before, no extra keys needed |
| Ecosystem support | One config per package manager, N separate tools to maintain, update, and monitor | 13 ecosystems — pip, apt, npm, Go, cargo, Maven, RubyGems, Composer, NuGet, Conda, CRAN, Helm, Docker. One binary, one config, one dashboard. |
| Cache visibility | Access logs only, no hit rate, no package analytics | Dashboard with hit rate, top packages, upstream health, latency percentiles |
| Multi-upstream failover | Manual upstream_hash or ip_hash, no health checks | Automatic health checks, latency-based selection, instant failover |
| Concurrent deduplication | Multiple clients trigger multiple upstream fetches | Singleflight: N concurrent requests = 1 upstream fetch |
| Maintenance | You own every edge case, every package manager update | We handle protocol changes, you just docker pull |
| Security scanning | Not included — need separate tools like Snyk or Trivy | Built-in CVE scanning via OSV.dev. Auto-block vulnerable packages above your CVSS threshold. |
Depsilo runs as a Docker container, a standalone binary, or a desktop app with native window. Your tools don't even know it's there, they just feel faster.
From startup offices to air-gapped labs — one tool, many contexts.
50 concurrent jobs all need the same packages. Without Depsilo, that's 50 upstream fetches and 50x the bandwidth. With Depsilo, it's one fetch and a fast LAN stream to everyone else.
Your office bandwidth is shared and limited. Depsilo sits on a local machine and absorbs all package traffic. Once a package is cached, the internet is no longer in the critical path.
No internet access in your build environment? Pre-populate Depsilo's cache from an external machine, then run fully offline. All cached packages remain available indefinitely.
Your team uses Python, Node.js, Go, and Java all at once. Instead of configuring four separate caches, Depsilo handles all of them from a single endpoint. One deployment, one dashboard, one place to check hit rates.
Every package your team downloads is checked for known CVEs automatically. Set CVSS thresholds per ecosystem, auto-block vulnerable versions, and export audit reports for compliance reviews.
Depsilo is self-hosted. Your data stays on your servers. Pay only for the features that matter at scale.
Self-hosted · MIT License · no license key required
14-day free trial · no credit card required · cancel anytime · your data stays on your servers
Ideal for 20+ developers or compliance-sensitive environments
All plans are self-hosted. We never see your packages, your code, or your network traffic. · Enterprise? Let's talk → hi@depsilo.com
"Our CI dropped from 8 minutes to under 2. torch and numpy were the culprits — now cached, every job flies. docker run and 15 minutes of config. That's it."
"Flaky office internet was making everyone miserable. Depsilo on a local NUC fixed it completely. apt install now feels like it's reading from disk."
"I evaluated self-configuring Nginx for this. The PyPI URL rewriting alone would have taken days to get right. Depsilo just handled it."
"We work in an air-gapped lab. Depsilo lets us pre-populate a cache from outside, then work at full speed with zero internet. Audit logs help us prove compliance."
Single binary. One config file. No runtime dependencies, no JVM, no Elasticsearch.
Uses SQLite and local filesystem by default. No other dependencies required.
Hit rate, top packages, upstream health, storage usage — no extra setup required. Prometheus metrics at /metrics.
Want docker-compose with PostgreSQL and S3? See the full deployment guide →
No Docker? Download Depsilo as a native desktop app for macOS, Windows, or Linux. Same features, native window, built-in setup wizard.
Download from GitHub Releases