Support

npm, PyPI, Maven, NuGet, Go, Cargo, Composer, Conda, and RubyGems, plus container images (OCI). Each has a setup page under Ecosystems, which also marks which are in beta.

The message contains a request ID. Follow Investigate a blocked install to trace it to the rule that fired, and Manage exceptions if the package should be allowed.

Usually a rule on the versions phase filtered it, most often a delay rule and a recently published version. Check the firewall logs before assuming an outage.

Add an exception: scoped to the package and version, with a reason and an expiry. The rule keeps applying to everything else.

The firewall proxies upstream responses and adds one network hop. It can also cache responses from internal upstreams, so repeated installs are served without a round trip to that registry. See Upstreams and caching.

Rule evaluation is ordered by cost rather than by configuration: a request pays for the expensive checks only when the cheaper rules have allowed it, and a block skips everything after it. See Evaluation order.

Yes, see Self-hosted.

Yes, in beta: a container firewall sits in front of Docker Hub and other OCI registries, checks the OS packages in each image for known vulnerabilities, and scans every layer for malware and secrets. Container firewalls are switched on per organization. Contact us and we will enable them for you.

What you expected, what happened instead, and the steps that produced the problem. When available, add the namespace ID, firewall ID, error text, and screenshots. Do not include access tokens.