Stop distributing PATs.
Every pull, logged and controlled.
Your team is sharing GitHub PATs with blanket access, hitting rate limits on repeat pulls, and flying blind on who pulled what. Drevnix is a self-hosted proxy in front of ghcr.io, Docker Hub, and ECR: scoped credentials per client, pull-through cache, and a full audit trail. Upstream passwords never leave the server.
ghcr.io access control is broken by default
Classic PATs, rate limits, no audit trail. If your team uses ghcr.io, you've hit these walls. Drevnix fixes all of them.
No Per-Repo Access Control
Fine-grained PATs don't support the Packages permission at all. Classic PATs give blanket read access to everything the account can see. Want to scope it down? You're looking at machine users or a custom GitHub App.
Credential Sprawl Across Every Registry
A GitHub PAT for ghcr.io. ECR access keys for production images. A Docker Hub token for base images. Rotating any one means updating secrets in 20 places. One leaked credential means cleanup across all of them. There's no central place to see or revoke what's been issued.
No Audit Trail
ghcr.io tells you a package exists. It won't tell you who pulled it, from where, or when. Good luck answering that during an audit.
Up and running in minutes
Three steps and your pipelines are pulling through Drevnix.
Configure Upstreams
Add ghcr.io, Docker Hub, ECR, and any other registries. Credentials are encrypted at rest. Nobody else has access.
Issue Client Identities
Create scoped clients for each developer and CI pipeline. Set permissions and expiry dates. Revoke any time.
Point docker pull at Drevnix
Clients authenticate to Drevnix. It handles auth, caching, and logs every pull. No upstream credentials ever leave the server.
A real admin panel. Not a config file.
Manage clients, upstreams, and audit logs from a clean web portal. No YAML required.
Self-hosted container registry access management, built in
Six specific problems that ghcr.io and vanilla registries leave unsolved: access control, credential isolation, pull caching, and audit logging.
What ghcr.io can't give you.
Classic PATs give read access to everything the account can see. Drevnix issues each client a token locked to exactly the images it needs. One pipeline sees one image.
Upstream passwords never leave the server.
Your registry passwords are encrypted on disk. Developers and pipelines get scoped tokens, not the real credentials. Revoking a client doesn't touch the upstream at all.
Know who pulled what, every time.
Every pull is logged: client identity, upstream, repo, tag, status, IP, timestamp. What auditors ask for is already there.
Pull once. Serve many.
50 parallel CI jobs hitting a 2GB base image all pull from local disk after the first hit. Your upstream bandwidth drops, and so do your rate limit headaches.
Access that actually expires.
Set an expiration date when you create a client. When it hits, access stops. No tickets, no forgotten cleanup, no contractors with stale credentials.
Your identity provider. Your portal rules.
Portal login via OIDC, GitHub OAuth, or AWS OIDC. Four built-in roles (Super Admin, Admin, Operator, Viewer) scope each team member to exactly what they need.
Built for two teams with one shared problem.
Two very different jobs. One shared frustration.
Stop fighting rate limits
and credential sprawl.
- ghcr.io classic PATs grant blanket package access with no way to scope it per repo short of machine accounts
- Rotating upstream credentials means updating secrets in 20 places
- No visibility into which services pull which images
Audit trail, access control,
and zero credential exposure.
- No log of who pulled production container images, or when
- Production registry credentials sitting in shared 1Password vaults
- Contractor access is hard to time-bound and impossible to audit
31 days free. No credit card. Deploy in minutes.
All features included. Self-hosted on your own infrastructure. Generate a license key instantly.