Self-hosted package firewall

Questions and answers

What is a self-hosted package firewall?

A self-hosted package firewall is a package firewall that runs on infrastructure you control instead of a vendor’s cloud. The firewall sits between your package managers and the public npm, PyPI and Maven registries, and decides on every install whether the package may be downloaded. Decisions, the audit log and the package cache stay inside your network boundary, so no third party sees which packages and versions your teams install. Self-hosting matters most in regulated environments and in air-gapped networks with no route to a SaaS service. A self-hosted firewall also serves cached packages locally and keeps working during a vendor outage. Chainsaw runs self-hosted in a VPC, on-premises or fully air-gapped, from the same binary as the SaaS version, with Sigstore-verified policy bundles and audit rows kept in your own Postgres.

Why self-host a package firewall?

• Your dependency list is sensitive. Which packages and versions you install describes your stack. A SaaS firewall sees every install request.
• Regulated or classified environments often cannot send build traffic to a third party at all.
• Air-gapped networks have no route to a SaaS service.
• Latency and availability. A firewall in your own network serves cached packages locally and keeps working if the vendor has an outage.

What should a self-hosted package firewall do?

1. Run fully offline when it has to, with a way to bring in new malware and vulnerability data that you can verify before loading it.
2. Use the same software as the hosted version, so you are not running a cut-down edition.
3. Sign its policies, so a tampered policy file is refused rather than enforced.
4. Keep an audit trail of every decision that you can export to your SIEM.
5. Let you read the decision logic, because you are putting it on the path of every build.
6. Expose metrics you can alert on: decisions by verdict, cache hit rate, the age of its threat data.

How does Chainsaw run self-hosted?

• One binary for every deployment. SaaS, your VPC, on-premises and air-gapped run the same binary with the same policy bundle and audit schema.
• Air-gapped mode. CHAINSAW_OFFLINE=1 makes no outbound connections. Threat data arrives as an intelligence bundle loaded from a path you choose; its digest is verified at start, and if verification fails the previous bundle stays in use.
• Signed policy. The policy bundle is verified with Sigstore when it loads. Turning verification off needs an explicit, audited workspace setting.
• Your data stays with you. Audit rows, exceptions and policy versions live in your Postgres; SBOMs and scan results in your blob store.
• Kubernetes admission. The same policy bundle can check pod and image specs at admission.
• Prometheus metrics and alerts for latency by verdict, cache hit ratio, policy bundle age, error rate and p99.
• Open source. The CLI and the decision engine are Apache-2.0 at github.com/chain305/chainsaw-core.

The reference architecture, with the four deployment topologies.

What does it cost to run?

Self-hosted and air-gapped deployment is part of the Enterprise plan, which starts at $36,000 a year and is the same software as the hosted plans. The open-source CLI is free and blocks known-malicious packages and typosquats offline with no account. Pricing.

Can a self-hosted firewall be bypassed?

Yes. A self-hosted package firewall is a proxy, and like any proxy-based firewall, a self-hosted one can be bypassed: one line in .npmrc or pip.conf sends a package manager straight to the public registry. Closing the bypass takes enforcement in three other places. First, a CI gate fails any build whose packages came from somewhere other than the firewall. Second, MDM settings (Jamf, Intune) pin laptops to the firewall URL, so an edited .npmrc does not stick. Third, egress rules block direct registry traffic and force requests back through the firewall. A developer who points pip.conf straight at pypi.org gets a failed CI build, because the gate sees packages that did not come through the firewall. Chainsaw ships all three controls and attests whether each gap is closed. The controls are defence in depth with detection, not a guarantee that nothing can ever get round the proxy. How enforcement closure works.