Universal Package Tags

A walkthrough of universal Package Tags - tag any package or container within Cloudsmith. Use them to search/filter and organize your software assets.

Entitlement Tokens

A walkthrough of Entitlement Tokens; how to create, restrict, and permission with the use of tokens using a Maven example.

We’re a little late to the party. Fashionably late.

By now the world knows that DockerHub has removed the free, untraceable goodness of anonymous pulls. How dare they? How dare they build a revolutionary technology, open-source it and give it away for free at a substantial cost to themselves. It’s worth calculating what a couple of petabytes of CloudFront bandwidth would cost, even with a substantial discount. It’s mind-blowing. And frankly unsustainable for any company that doesn’t have a multitude of revenue streams.

Why have public when you can have private?

 at the request of a customer about two years ago. At the time, we thought it was unlikely that we’d be picked over AWS ECR (other Cloud provider container registries are available) but we were pleasantly surprised to find that a single pane of glass for all assets is a huge draw for our customers.

We’ve built Cloudsmith to normalize, where possible, the diverse list of formats as much as possible; so that Docker images can sit beside the very dependencies they contain.

The truth is, untraceable, anonymous access is bad for software delivery. It really should be a thing of the past. Organizations must build security into their processes and workflows at the far left, with tools like Snyk, and at the point of deployment or distribution with tools like Cloudsmith.

We believe that building up a provenance trail is vital to monitor and control your risk.

The move from DockerHub, while it might cost you money, is actually a step in the right direction for everyone. Control over public upstreams is vital, and this move shines a light on the problem, and will, for many, force action toward a better, more secure, way of doing things.

DockerHub vs Cloudsmith Private Docker Registry

Our distinguished competition took a puzzling position of “Imagine there’s no versions”.

At Cloudsmith we think that’s crazy. Software versions are what makes software development possible. They make deployment possible. They make distribution possible. How else can you understand and navigate complex dependency trees or be sure your code will interact with a third party’s? Hint - you can’t!

You must care about versions. And updates. It’s the only way to know you are on the latest build; the one with the security fixes and new features. But it’s not about the end-user. It’s about you. How else can you label or tag the push of a new build that’s been verified?

Not a single one of our customers has ever asked us how to architect, build, and deploy versionless software.

The revolution against versions hasn’t begun - and never will. Versions are here to stay. There is an explosion in the amount of open-source software that all software relies upon, and the only way to manage the chaos is with versioning.

 containers are filled with versioned software. You need to know what’s in each and every layer.

Now more than ever, engineers, like you, and like us, need better tools to track, manage, and understand all software pulled into your stack. Cloudsmith was built to tackle this problem, providing a single source of truth across every format you use; providing isolation from public upstreams, and allowing you to interrogate the provenance of any package with insight into security and licensing. These are vital for everyone going forward.

But more than that, there are three key reasons why versions are so important:

More bluntly - “Knowing what is where”. The dependency tree for any piece of modern software can be vast. You need proper visibility on what packages, libraries and components make up this tree because without it you really are running blind, in more ways than one. Without versions, you don’t have this visibility, and you’re missing the details of the “what”.

Once you know “What is where” you need to explore “When did something change?”. You should be able to trace back when a particular package or library was updated, modified or even rolled back. Without versions, you can’t do any of this - it’s like a financial audit without figures: it’s lacking the very detail that it requires to be effective.

And finally, you need to know “Will this actually work?” You can see what you have, you know when things changed, and now you can determine if the sum of these will, in effect, “make” or “break”. Without versions, you can’t tell. You can’t plan, implement or react effectively. You’re adrift in a sea of unknowns. Breaking changes are real, we have all seen them. This is one of the most important reasons why versions matter.

While we admire the sentiment of imagining a world with no software versions; it’s just not realistic. We fundamentally believe in the opposite; and will continue to build a platform that gives you a more profound understanding of versions; not one that muddies the very clarity you need to develop better, faster, more maintainable products.

Infinity Welcomes Careful Versioning

Provisioning Cloudsmith with the Terraform Provider

A quick demonstration of how to use the Cloudsmith Terraform Provider to provision a private repository and some entitlement tokens.

Getting Started with LuaRocks and Cloudsmith

A short demo of how to get started with LuaRocks modules and Cloudsmith, including uploading a LuaRocks module to a private Cloudsmith repository and then downloading and installing it.

https://help.cloudsmith.io/docs/luarocks-repository

At Cloudsmith we love playing video games, everything from Super Meat Boy to Halo, Fortnite to Candy Crush. We’ve got a big Pac Man money box sitting on the office shelf. Steve Collins, of Havok fame, is on our Board of Directors. Quite simply, gaming is in our DNA.

When we started Cloudsmith we made a list of customers we’d love to work with someday and there were numerous games studios on the list. It was a proud moment for the team when the first games company signed up to distribute its software globally. Since then more major studios have followed suit. It’s truly exciting to be a part of the deployment and delivery process for companies we really admire.

We pay homage to a few video game greats with our pop culture banners in our documentation; see 

. Can you guess the games on which each is based?

Cloudsmith can solve many problems for games companies, but what is most unique about a games company is that they are the software companies that can make use of all three of our primary use cases:

The beating heart of any games company is its Intellectual Property. Now, of course, this consists of game characters, themes, and franchises, but it also consists of a lot of proprietary code, libraries and packages, game engine components, and sound and graphic assets. Protecting this IP, while also granting globally distributed internal development teams easy access so that they can work with it is a major challenge. Cloudsmith private repositories allow a games company to centrally manage its software assets, provide secure access for development teams worldwide, and also deliver performant global availability.

A games company requires a lot of infrastructure to operate effectively. Significant resources are required to facilitate both internal development teams and any customer-facing environments for matchmaking and multiplayer services. This may take the shape of on-prem servers or cloud-based environments, but building and managing this infrastructure is a complex task. Even when automated through tools such as Terraform, Ansible, Puppet, Chef, and others, it still requires that these tools have a central source-of-truth for the packages and modules that they require. The universal package support offered by Cloudsmith means that it is easier for internal DevOps teams to manage these builds and deployments.

Games companies often need distribution of software assets and packages for a few different use cases, like distribution of software assets to licensed customers or distribution of packages and libraries to 3rd party development partners. To do this, they require fine-grained control over access, and visibility into download activity and usage. Cloudsmith’s extremely flexible Entitlement Token system allows the creation of unique, read-only access tokens that grant access to specific packages or assets. These tokens can have multiple restrictions attached, such as limiting access to specific packages, for a specific timeframe, from specific locations, and even a maximum number of downloads or bandwidth use. Any read activity on the repository is attributed and associated with an Entitlement Token and therefore users can be precisely monitored and analyzed.

As an example, we’re solving two use-cases for one such customer:

Supporting the management of Debian deployments to their IT infrastructure, including isolating public packages through our recently launched Upstream Proxy & Caching feature,

Enabling the distribution of private core dependencies to their partners, which utilizes our Entitlement token system.

As we mentioned, we love playing video games, and being part of the deployment and delivery process for companies that create them is something we’ll be forever excited about. Whether it’s 

, or the full trifecta, Cloudsmith is here to help support and solve many of the problems games companies face all in one platform.

Don’t just take our word for it though - 