a private Alpine repository that remembers
One line in /etc/apk/repositories and Alpine hosts, and far
more often container builds, pull through gastropod: a caching mirror of upstream apk
repositories, a home for your own packages, and a memory of exactly which images and
hosts carry which package when an advisory drops.
connect in one line
# /etc/apk/repositories https://gastropod.io/apk/<repo>
apk add and apk upgrade work unchanged.
what happens on every apk add
- Identity is fixed. The package resolves to an exact PURL, version, and sha256 digest.
- Integrity is checked at intake against the repository's signed index, before a package is served.
- Advisories are correlated. Known OSV advisories attach to the exact version and map across everything downstream of it.
- The pull is recorded. Which principal, a host, a CI job, an image build, pulled which package, when. Exportable.
- It's remembered. Findings and where-seen history stay on the digest for every later pull.
inside every image
Alpine's real footprint isn't servers; it's FROM alpine at
the top of half the world's Dockerfiles. Its packages don't live on hosts you can inventory;
they live inside images, copied into layers, rebuilt nightly, and shipped everywhere. When
an advisory lands on an apk package, the operative question is which images contain it and
which services run those images, a question most organizations answer by re-scanning
everything they've ever built. Gastropod answers it from memory. Packages pulled during
image builds are recorded and identified at intake; because storage is content-addressed,
the same package in a hundred images is one digest with one record; and the where-seen
history plus blast-radius graph turn "which images carry it" into a query. Paired with the
Docker registry side, both halves of the
container supply chain, the base packages and the images they end up in, share one audit
spine.
proxy, hosted, virtual
proxy
A caching mirror of upstream Alpine repositories. The first pull fetches, verifies, and stores deduplicated.
hosted
Your own apk packages, token-gated, served from the same endpoint.
virtual
One repositories line covering both.
Every feature is on every tier: OIDC SSO, scoped tokens, SBOMs, blast radius, and audit are all present starting at our published rates.
FAQ
can gastropod mirror Alpine's package repositories?
Yes. Proxy mode fronts upstream apk repositories, verifying and caching packages locally so image builds and hosts stop depending on upstream mirrors.
does this work for container image builds, not just Alpine hosts?
That's the main event. Point the build's /etc/apk/repositories
at gastropod and every package entering your images is identified, verified, and
recorded, so images inherit a paper trail instead of a mystery.
how do I find which images contain an affected apk package?
The where-seen history and blast-radius graph key everything to the package digest: when an advisory lands, the affected digest lists every artifact and consumer that carries it, with no fleet-wide re-scan.
can I host internal apk packages?
Yes. A hosted repository serves your own packages through the same endpoint as the mirror, token-gated with reader and publisher roles.
do repeated image builds hammer upstream?
No. The first pull caches into content-addressed storage; every later build pulling the same digest serves locally, deduplicated across the instance.
Part of the full product overview. Also speaking: apt.
Alpine Linux is a trademark of the Alpine Linux project. Gastropod is not affiliated with Alpine Linux. Details current as of July 2026.