ocharted is a stateless OCI registry proxy that makes any classic HTTP Helm repository pullable as OCI artifacts, enabling GitOps tools like Flux to use standard OCI workflows without onboarding or storage.

Stars

7

7-day growth

No data

Forks

0

Open issues

2

License

Apache-2.0

Last updated

2026-07-28

AI repository intelligence
FR-AI / ANALYSIS

Why it is worth attention

It provides a deterministic, coordination-free bridge between classic Helm repos and OCI, with hard invariants that ensure byte-identical responses across replicas, plus built-in cosign signing, provenance passthrough, SSRF protection, and a documented Renovate integration.

Who it is for

  • Flux/GitOps users who need to consume classic Helm repos as OCI artifacts
  • Helm users who want to pull charts via `helm pull oci://` without migrating repos
  • Renovate users wanting automated updates for charts served through an OCI proxy
  • Homelab or self-hosted infrastructure operators seeking a lightweight, stateless proxy

Use cases

  • Using a Flux `OCIRepository` to reconcile charts from any Helm repo as OCI artifacts
  • Pulling Helm charts with `helm install oci://...` from classic repos without OCI support
  • Enabling Renovate to discover and update chart versions through the proxy's OCI tags endpoint
  • Adding cosign signature verification to ensure charts only enter the cluster through your proxy

Strengths

  • Stateless and deterministic: all responses are pure functions of upstream bytes, enabling coordination-free multi-replica HA
  • Supports cosign signing (Ed25519) and Helm provenance passthrough for integrity attestation
  • SSRF protection with upstream host allowlist and private-address dial guard
  • Comprehensive operational features: Prometheus metrics, caching, caching headers, structured logs, graceful drain, and spec-compliant pagination

Considerations

  • Read-only proxy; charts are not rehosted—deletion upstream means they become unavailable
  • Dependency rewriting changes served digests, requiring opt-in and breaking upstream provenance
  • Cold requests incur one or two upstream fetches, and large indexes may require tuning timeouts

README quick start

Usage

Description

A stateless OCI registry proxy that serves classic Helm repositories as OCI artifacts

Related repositories

Similar projects matched by category, topics, and programming language.

deerwork-ai
Featured
deerwork-ai GitHub avatar

deer-workflow

An open-source Dynamic Workflow runtime that combines deterministic TypeScript orchestration with replaceable Agent runtimes.

AI & Machine LearningLarge Language Models
312
yaojingang
Featured
yaojingang GitHub avatar

TokHub

TokHub is an open-source monitoring, recommendation, and OpenAI-compatible gateway system for AI API intermediaries, combining public status pages, supplier rankings, user workspaces, layered probing, metering, alerts, encrypted keys, and Docker self-hosting.

AI & Machine LearningBackend & APIs
189
amitshekhariitbhu
Featured
amitshekhariitbhu GitHub avatar

ai-agents-tutorial

A comprehensive step-by-step tutorial series that teaches AI agents from scratch, covering function calling, agent loops, ReAct, reflection, plan-and-execute, multi-agent systems, orchestration, evaluation, and related concepts like RAG, GraphRAG, and LangChain.

AI & Machine LearningLarge Language Models
136