Open Source · Free hosted service

Helm Chart OCI Proxy

Pull any classic Helm chart repository as an OCI artifact. Point Helm, Harbor or Skopeo at the proxy and every chart repository behaves like an OCI registry.

helm pull oci://chartproxy.container-registry.com/charts.jetstack.io/cert-manager

Get Started View on GitHub

Diagram: Helm clients and Harbor pull OCI artifacts from the Helm Chart OCI Proxy, which fetches charts from classic chart repositories such as charts.bitnami.com and charts.jetstack.io

Why a Chart Proxy

Helm moved to OCI. Thousands of third-party charts did not. The proxy closes that gap without touching the upstream repositories.

Any Chart Repo as OCI

Address every public chart repository through one OCI reference scheme. No helm repo add, no index files on the client.

Harbor 2.8+ Ready

Harbor dropped ChartMuseum. Add the proxy as a registry endpoint and replicate classic chart repositories into Harbor projects as OCI charts.

Works With Your Tooling

The proxy speaks the Registry v2 API. Helm, Skopeo, ORAS and crane pull from it and copy charts into any OCI registry you already run.

Dependency Rewriting

Optionally rewrite the dependency URLs inside Chart.yaml so subcharts are fetched through the proxy too, globally or per request.

Self-Host in Minutes

A single Go binary with in-memory caching. One helm install from our OCI registry, or run the container anywhere.

Built Into 8gears Container Registry

The proxy ships inside 8gears Container Registry. Proxy chart repositories from the Harbor UI without running a separate service.

How It Works

A stateless translation layer between two chart distribution formats.

Step 1

You request an OCI reference

The path encodes the upstream repository host and the chart name: oci://chartproxy.container-registry.com/charts.jetstack.io/cert-manager. The tag is the chart version, or omitted for latest.

Step 2

The proxy fetches the chart

It reads the repository's index.yaml, resolves the version, downloads the chart tarball and caches both. Nothing is stored long term.

Step 3

You receive an OCI artifact

The tarball is wrapped in an OCI manifest with the Helm media types and served through the Registry v2 API, exactly as an OCI-native chart would be.

Usage

The proxy maps a chart repository host and chart name onto an OCI reference:

oci://chartproxy.container-registry.com/<chart-repository-host>/<chart-name>

Pull cert-manager from charts.jetstack.io as an OCI chart:

helm pull oci://chartproxy.container-registry.com/charts.jetstack.io/cert-manager --version 1.11.2

Without --version the proxy resolves the latest version listed in the repository’s index.yaml:

helm pull oci://chartproxy.container-registry.com/charts.bitnami.com/bitnami/airflow

helm install and helm template work the same way. There is no helm repo add step.

Use with Harbor

Harbor 2.8 removed ChartMuseum and with it support for classic chart repositories. With the proxy, Harbor can replicate any chart repository as OCI artifacts.

Add one registry endpoint per chart repository. Set the provider to Docker Registry and the endpoint URL to the proxy followed by the repository host, for example https://chartproxy.container-registry.com/charts.jetstack.io.

Harbor registry endpoint pointing at the Helm Chart OCI Proxy

Then create a replication rule that pulls from that endpoint into a Harbor project.

Harbor replication rule for the Helm Chart OCI Proxy endpoint

Copy charts into any OCI registry

Since the proxy speaks the Registry v2 API, any OCI tool can copy charts out of it, for example Skopeo:

skopeo copy \
  docker://chartproxy.container-registry.com/charts.jetstack.io/cert-manager:1.11.2 \
  docker://registry.example.com/charts/cert-manager:1.11.2

Dependency rewriting

Chart dependencies carry hardcoded https:// repository URLs in Chart.yaml. When REWRITE_DEPENDENCIES is enabled on a self-hosted proxy, those URLs are rewritten to go through the proxy as well, so parent chart and dependencies are all fetched as OCI artifacts. Per request, append ?rewrite_dependencies=true or =false to the reference.

Rewriting modifies Chart.yaml inside the tarball and therefore breaks provenance verification with helm verify. Leave it off when you rely on .prov files.

Self-hosting

The proxy is a single Go binary with no external dependencies. The Helm chart is published as an OCI artifact, so one command installs it:

helm install chartproxy --create-namespace --namespace chartproxy \
  oci://8gears.container-registry.com/library/helm-charts-oci-proxy

Outside Kubernetes, run the container image directly:

docker run -p 9000:9000 8gears.container-registry.com/library/helm-charts-oci-proxy

Configuration is done through environment variables:

Variable	Default	Purpose
`PORT`	`9000`	Listen port
`USE_TLS`	`false`	Serve HTTPS using `CERT_FILE` and `KEY_FILE`
`INDEX_CACHE_TTL`	`14400`	Seconds to cache a repository’s `index.yaml`
`INDEX_ERROR_CACHE_TTL`	`30`	Seconds before retrying a failed index fetch
`MANIFEST_CACHE_TTL`	`60`	Seconds to keep converted manifests and blobs
`REWRITE_DEPENDENCIES`	`false`	Rewrite chart dependency URLs through the proxy
`PROXY_HOST`	request `Host`	Host used in rewritten dependency URLs
`ALLOW_PRIVATE_NETWORKS`	`false`	Allow upstream repositories on private or loopback addresses
`DEBUG`	`false`	Verbose logging

Source, issues and releases live on GitHub. The chart is listed on Artifact Hub.

Prefer It Built In?

8gears Container Registry proxies chart repositories natively, backed by the engineers who maintain Harbor.

Explore 8gears Container Registry Talk to Our Team