For the complete documentation index, see llms.txt. This page is also available as Markdown.
Google Cloud Artifact Registry
Route your registry traffic through Aikido's registry proxy by configuring Google Cloud Artifact Registry as an intermediary. Artifact Registry pulls packages from Aikido instead of the public registries, so every package your team installs is checked for malware, age restrictions, and known vulnerabilities.
In the Google Cloud Console, go to Artifact Registry > Repositories.
Click Create Repository.
Give the repository a name, for example aikido.
Set Format to match your ecosystem (npm, Python, or Maven).
Set Repository mode to Remote.
Under Remote repository source, select Custom.
In the Custom repository field, paste your Aikido proxy URL from step 1.
Set Remote repository authentication mode to Unauthenticated.
Choose a Region and click Create.
The Custom repository URL is immutable after creation. If you need to change it, delete the repository and create a new one.
3
(Optional) Create a Virtual Repository
If you also publish internal packages to a Standard repository in Artifact Registry, create a Virtual Repository that aggregates both:
Go to Artifact Registry > Repositories > Create Repository.
Set Format to match your remote repository and Repository mode to Virtual.
Add your Standard repository and the Remote repository from step 2 as upstream repositories.
Assign a priority to each upstream: higher priority is preferred when a package exists in multiple upstreams.
Point your package manager at the Virtual Repository URL instead.
This gives your team a single registry endpoint that serves both internal packages and externally proxied packages through Aikido.
4
Configure Developer Machines to use Artifact Registry
Point each developer's package manager at the Artifact Registry repository (the Virtual Repository, if you created one). See Google Cloud's documentation for the exact steps:
(Optional) Block the public registry with Device Protection
Once Artifact Registry is in place, developers can still bypass it by pointing their package manager directly at the public registry. Deploy Aikido Device Protection to enforce that all traffic goes through your private registry.
