---
title: "Helm Chart OCI Proxy"
description: "Pull any classic Helm chart repository as an OCI artifact. Free hosted service at chartproxy.container-registry.com, open source, and built into 8gears Container Registry."
canonical: "https://container-registry.com/helm-charts-oci-proxy/"
source: "https://container-registry.com/helm-charts-oci-proxy/index.md"
agent_instructions: "Section index for https://container-registry.com/helm-charts-oci-proxy/index.md. Each linked entry has a markdown twin (append index.md to the URL). The site index is at https://container-registry.com/llms.txt."
---

> Agent-friendly representation of <https://container-registry.com/helm-charts-oci-proxy/index.md>. Site index: <https://container-registry.com/llms.txt>.


# Helm Chart OCI Proxy

*Pull any classic Helm chart repository as an OCI artifact. Free hosted service at chartproxy.container-registry.com, open source, and built into 8gears Container Registry.*


## Usage

The proxy maps a chart repository host and chart name onto an OCI reference:

```text
oci://chartproxy.container-registry.com/<chart-repository-host>/<chart-name>
```

Pull `cert-manager` from `charts.jetstack.io` as an OCI chart:

```bash
helm pull oci://chartproxy.container-registry.com/charts.jetstack.io/cert-manager --version 1.11.2
```

Without `--version` the proxy resolves the latest version listed in the repository's `index.yaml`:

```bash
helm pull oci://chartproxy.container-registry.com/charts.bitnami.com/bitnami/airflow
```

`helm install` and `helm template` work the same way. There is no `helm repo add` step.

### Use with Harbor

Harbor 2.8 removed ChartMuseum and with it support for classic chart repositories. With the proxy, Harbor can replicate any chart repository as OCI artifacts.

Add one registry endpoint per chart repository. Set the provider to *Docker Registry* and the endpoint URL to the proxy followed by the repository host, for example `https://chartproxy.container-registry.com/charts.jetstack.io`.

![Harbor registry endpoint pointing at the Helm Chart OCI Proxy](/helm-charts-oci-proxy/harbor_registry_endpoint.png)
{.zoomable}

Then create a replication rule that pulls from that endpoint into a Harbor project.

![Harbor replication rule for the Helm Chart OCI Proxy endpoint](/helm-charts-oci-proxy/harbor_replication_rule.png)
{.zoomable}

### Copy charts into any OCI registry

Since the proxy speaks the Registry v2 API, any OCI tool can copy charts out of it, for example [Skopeo](https://github.com/containers/skopeo):

```bash
skopeo copy \
  docker://chartproxy.container-registry.com/charts.jetstack.io/cert-manager:1.11.2 \
  docker://registry.example.com/charts/cert-manager:1.11.2
```

### Dependency rewriting

Chart dependencies carry hardcoded `https://` repository URLs in `Chart.yaml`. When `REWRITE_DEPENDENCIES` is enabled on a self-hosted proxy, those URLs are rewritten to go through the proxy as well, so parent chart and dependencies are all fetched as OCI artifacts. Per request, append `?rewrite_dependencies=true` or `=false` to the reference.

Rewriting modifies `Chart.yaml` inside the tarball and therefore breaks provenance verification with `helm verify`. Leave it off when you rely on `.prov` files.

## Self-hosting

The proxy is a single Go binary with no external dependencies. The Helm chart is published as an OCI artifact, so one command installs it:

```bash
helm install chartproxy --create-namespace --namespace chartproxy \
  oci://8gears.container-registry.com/library/helm-charts-oci-proxy
```

Outside Kubernetes, run the container image directly:

```bash
docker run -p 9000:9000 8gears.container-registry.com/library/helm-charts-oci-proxy
```

Configuration is done through environment variables:

| Variable | Default | Purpose |
|---|---|---|
| `PORT` | `9000` | Listen port |
| `USE_TLS` | `false` | Serve HTTPS using `CERT_FILE` and `KEY_FILE` |
| `INDEX_CACHE_TTL` | `14400` | Seconds to cache a repository's `index.yaml` |
| `INDEX_ERROR_CACHE_TTL` | `30` | Seconds before retrying a failed index fetch |
| `MANIFEST_CACHE_TTL` | `60` | Seconds to keep converted manifests and blobs |
| `REWRITE_DEPENDENCIES` | `false` | Rewrite chart dependency URLs through the proxy |
| `PROXY_HOST` | request `Host` | Host used in rewritten dependency URLs |
| `ALLOW_PRIVATE_NETWORKS` | `false` | Allow upstream repositories on private or loopback addresses |
| `DEBUG` | `false` | Verbose logging |

Source, issues and releases live on [GitHub](https://github.com/container-registry/helm-charts-oci-proxy). The chart is listed on [Artifact Hub](https://artifacthub.io/packages/search?repo=helm-charts-oci-proxy).