Formats and running it
A PyPI proxy and private Python index
Switch PyPI on, add https://pypi.org as an upstream, and the same box is a Python package index at /pypi/simple/.
pip config set global.index-url https://packages.example.com/pypi/simple/From then on pip is used the way it always is. pip resolves among the releases the rules allow, since the rest are not listed, so a range steps around a blocked release. Requires-Python and yanked releases behave as they do on PyPI. uv, Poetry and anything else that takes an index address use the same one, with the token in the address or in a keyring.
It speaks the index the way PyPI does: HTML and JSON project pages (PEP 503 and 691, with sizes and versions from PEP 700), metadata files so resolvers can read dependencies without downloading wheels (PEP 658), and the JSON API. Every file is checked against the hash its index published before it is cached or served.
Uploading
twine upload to the index root with a token as the password, for reserved projects only. Each file must belong to the project and version the upload names, and match the SHA-256 the client sends. Uploaded files never change, and start in quarantine like an npm publish.
In short
- pip, uv and Poetry, PEP 503, 691, 658 and 700
- Rules, cooling off, safe versions, licenses and malware scanning, same as npm
- Every file hash checked against the index
- twine uploads for reserved projects
- A release is every file of it when caching, wheels and sdist
In the documentation
- Set up pip Developer Guide
- Install Python packages Developer Guide
- Set up uv Developer Guide
- Set up Poetry Developer Guide
- Publish a Python package Developer Guide
Goes well with
- Private npm registry npm, pnpm, Yarn and Bun. Publish your own packages under reserved names, mirror the rest.
- Docker registry mirror Pull through Docker Hub, GHCR, Quay or Harbor, and push your own images to reserved namespaces. Everything by digest, the layers scanned.
- License policy Allowed, needs review and blocked SPDX lists, with holds that follow a license change.
One container, about two minutes
A Linux box with Docker, or one without it, and a reverse proxy for TLS. The installer does the rest and it is safe to run twice. Free, MIT licensed, nothing to sign up for.