a private Helm chart repository that remembers
A chart is the artifact that deploys all the other artifacts: it pins images, versions, and configuration across every cluster that installs it. Gastropod gives charts the same treatment as everything else in your supply chain: verified intake, advisories, and a record of which cluster pulled which release.
connecting is as easy as
helm registry login gastropod.io helm push mychart-1.0.0.tgz oci://gastropod.io/<org>/<repo> helm install myrelease oci://gastropod.io/<org>/<repo>/mychart --version 1.0.0
Charts distribute as OCI artifacts, so helm install and
helm upgrade work unchanged once a chart is pushed.
what happens on every chart pull
- Identity is fixed. The chart resolves to an exact name, version, and digest, not a repo index entry that can be regenerated.
- Provenance is checked. Chart integrity is verified against Sigstore attestations carried as OCI referrers, the same mechanism gastropod uses for container images, before the chart is served.
- What it deploys is connected. The chart's place in the graph links toward the images it ships, so an advisory on an image can surface the charts and releases that deliver it.
- The pull is recorded. Which principal, a cluster, a CD pipeline, a developer, pulled which chart version, when. Exportable.
- It's remembered. Findings and where-seen history stay on the chart's digest across every later install.
charts deploy everything else
When an advisory lands on a container image, the container-side
question is which images contain it, but the operational question is one hop further: which
charts ship that image, and which clusters installed those charts? Charts are where an
image version becomes a running workload, and most organizations have no record connecting
the two; the answer lives in scattered values.yaml files and CD pipeline
history. Gastropod holds both ends of that chain. Images live in the
OCI registry with their digests and
findings; charts live here with their pull history; and the graph between them turns "what
do we actually run that's affected" into a query instead of a search through Git and CD
logs.
hosted, with the same controls as everything else
Charts push privately to a hosted repository, token-gated with reader and publisher roles. Every feature is on every tier: OIDC SSO, scoped tokens, SBOMs, blast radius, and audit are all present starting at our published rates.
FAQ
does gastropod support Helm charts as OCI artifacts?
Yes. Charts distribute as OCI artifacts, which pairs naturally with gastropod's OCI registry: the same push, pull, and signing model applies.
can I host private charts?
Yes. Hosted chart repositories are private by default, token-gated, with reader and publisher roles enforced per token.
can gastropod tell me which clusters pulled a chart?
Every pull is attributed on the audit spine: which principal pulled which chart version, when, so release forensics start from a query rather than CD-log archaeology.
how does this connect to the images my charts deploy?
Charts and images share one registry and one graph: an advisory on an image digest can surface the charts that ship it and the consumers that pulled them.
can it run alongside ChartMuseum or our current chart repo?
Yes. Helm handles multiple repositories natively, so gastropod can serve one team or one chart set during evaluation.
Part of the full product overview. Also speaking: Alpine · OCI.
Helm is a trademark of The Linux Foundation. Gastropod is not affiliated with the Helm project. Details current as of July 2026.