Backpack is a high-performance, distributed system for people whose security teams have serious trust issues. It is engineered for those building in the quiet, isolated comfort of air-gapped bunkers who still need their 4GB of node_modules despite having zero bytes of external connectivity.
At its core, Backpack is a one-way artifact collection and tracking engine. It doesn't host repositories or serve files to your developers; instead, it acts as a tireless background harvester. It recursively resolves dependency trees for entire ecosystems (npm, NuGet, PyPI, container images, Helm, Terraform, Hugging Face, Git and more), fetches every available version, and persists them into S3-compatible storage for later transfer to your isolated environment.
Think of it as a professional-grade, recursively-obsessive digital hoarder: Backpack siphons every version and every dependency from the public internet and stuffs them into your private storage. It harvests all, presents nothing, and ensures that when the internet inevitably lets you down (or your firewall is just that good), your codebase is already stocked for the long-term survival of your builds.
- You add an artifact (
lodash,docker.io/library/alpine,git://github.com/owner/repo, ...) in the GUI or through the API. - The ecosystem's processor asks the upstream registry for every version, the files that make up each version, and the artifact's direct dependencies.
- Core.Gateway stores what changed in MongoDB, hands the files to Collector.Router, and sends every dependency to its processor in turn, until the whole dependency tree is known.
- Collectors download each file that isn't in the bucket yet, store it under
<module>/<host><path>, and record it in a daily delta folder, so you know exactly what to carry across the air gap. - Tracker.Scheduler re-tracks ecosystems on a schedule to pick up new versions.
Everything talks through RabbitMQ, so each ecosystem and protocol is its own small service that you deploy only if you need it.
- Try it:
example/runs a complete, single-machine stack with Docker Compose. - Develop: start the infrastructure from
Compose/and run the services from your IDE; see Development Setup. - Deploy: Kubernetes via the Helm chart; see the Deployment Guide.
- Architecture Diagrams: components, queues and the life of an artifact.
- Service Inventory: every processor and collector, with its queues and what it needs.
- Storage Architecture: how collected files are laid out in the bucket, and delta links.
- Glossary: the terms used in the code and documentation.
- Type Reference: artifacts, messages and stored documents.
- Deployment Guide: infrastructure, images, Helm and Compose, sign-in, security notes.
- Configuration: every environment variable, and processor definitions.
- Development Setup: a local stack for working on Backpack.
- Troubleshooting: following an artifact through the system, and common problems.
- Processor Development: adding an ecosystem with the .NET template.
- Raw Integration: processors and collectors in other languages.
- Integration.API: REST endpoints, roles and API keys.
- Contributor standards: conventions for code in this repository.
Every service has its own README with its queues, settings and behaviour.
- Runtime: .NET 8 (C#), one container image per service.
- Messaging: MassTransit on RabbitMQ.
- Persistence: S3-compatible object storage (artifacts), MongoDB (artifact metadata, settings, events), Redis (per-ingest dependency tracking).
- Observability: OpenTelemetry traces, metrics and logs over OTLP.
- Security: any OIDC provider, an
Administratorrole, API keys for automation, optional approval of requests per ecosystem.
- RabbitMQ with the management and delayed-message-exchange plugins (the
masstransit/rabbitmqimage has both). - S3-compatible storage: MinIO, SeaweedFS, Ceph, AWS S3, ...
- MongoDB and Redis.
- An OIDC provider, e.g. Keycloak.
- A container registry, only if you mirror container images.