Quickstart

Log in to your registry

nem reads Docker's credentials, so logging Docker in logs nem in:

docker login registry.corp.example      # nem reads ~/.docker/config.json

A registry on localhost needs no TLS setup; anything else with a private CA or plain HTTP needs a hosts: entry first, see Access and rollout.

Mirror the catalog

nem catalog mirror ghcr.io/vi-dev/nem-catalog:v4 registry.corp.example/nem/catalog:v4 --dry-run   # what would be copied
nem catalog mirror ghcr.io/vi-dev/nem-catalog:v4 registry.corp.example/nem/catalog:v4             # copy it

Both references need a tag or digest. The run copies the index and every package manifest, then every archive the source has, and ends with a summary:

OK Mirrored 829 packages, 147 tags

829 packages but only 147 archive tags: the official catalog carries archives for packages built from source and for little else. Everything else still points at upstream downloads, which is what the next step fixes.

Fill the archives

nem catalog fill registry.corp.example/nem/catalog:v4 --package jq --dry-run   # start with one package
nem catalog fill registry.corp.example/nem/catalog:v4 --package jq             # download, verify, publish
nem catalog fill registry.corp.example/nem/catalog:v4                          # everything, when ready

fill downloads each version's artifact for every platform, verifies it against the manifest's checksum, and publishes it as an archive beside your copy of the index. It runs against your mirror because publishing needs push access. The first run for jq publishes four archives, one per platform:

OK Filled jq (4 fills, 0 heals) (2s)
OK Filled 1 package, 4 fills, 0 heals, 0 present, 0 packages not fillable

A second run finds everything present:

OK Filled 1 package, 0 fills, 0 heals, 4 present, 0 packages not fillable

The full catalog is a lot of downloads; --package for the packages your developers use is a good starting scope.

Add it and use it

nem catalog add corp registry.corp.example/nem/catalog:v4   # appended after official
nem catalog reorder corp official                           # make it win over official

Or, if the mirror should be the only source, nem catalog disable official instead of the reorder. Then, in any project:

nem use jq                                                  # resolves from corp, installs from your registry

The first nem use updates the new catalog. Archives resolve from your registry automatically, because their location is derived from the catalog reference.

Tell developers

Each developer runs the same nem catalog add, or gets a ready config.yaml; Access and rollout covers both, and Keeping a mirror current covers the refresh loop.