OrbitalReg
Sign in →

Migration

Migrate from Artifactory or Nexus
without rewriting your CI.

OrbitalReg ships first-class importers for JFrog Artifactory, Sonatype Nexus Repository, GitHub Packages, GitLab and the cloud registries. Your developers keep using the same push and pull commands — only the URL changes. Three migration strategies cover every risk profile, from "downtime is fine" to "zero-tolerance for outages", and the orbital migrate CLI verifies the result before you cut over.

Deciding rather than migrating yet? See OrbitalReg as a JFrog Artifactory alternative, as a Sonatype Nexus alternative, and JFrog's pricing next to ours.

Where you're coming from

Seven first-class importers — every major registry covered.

Each importer ships in the OrbitalReg core. No add-on, no separate licence, no third-party migration tool to evaluate.

JFrog Artifactory

Repositories, artifacts, properties, build-info envelopes — all migrate via the orbital migrate plan inventory pass and bulk-importer.

Formats: All major formats

Watches and Xray policies map to OrbitalReg pull-gate policies.

Migrating from JFrog Artifactory — step-by-step guide ↗

Sonatype Nexus

Format-by-format migration. Maven, npm, Docker, NuGet, RubyGems, PyPI, Helm, Conan, Raw — pulled in parallel where bandwidth allows.

Formats: Maven, npm, Docker, NuGet, RubyGems, PyPI, Helm, Conan, Raw

Both OSS and Pro source instances supported. Repository-level permissions migrate to OrbitalReg roles.

Migrating from Sonatype Nexus — step-by-step guide ↗

GitHub Packages

Per-org migration with a GitHub PAT. Permissions follow GitHub team mappings; repository scopes translate to OrbitalReg projects.

Formats: Maven, npm, Docker, RubyGems, NuGet

GitHub Enterprise Server and GitHub.com both supported.

Migrating from GitHub Packages — step-by-step guide ↗

GitLab Package Registry

Self-hosted GitLab and GitLab.com supported. Group + project scopes map to OrbitalReg projects + repos.

Formats: Maven, npm, Docker, NuGet, PyPI, Conan, Composer, Helm

GitLab CI OIDC tokens translate to OrbitalReg OIDC trust policies natively.

Migrating from GitLab Package Registry — step-by-step guide ↗

Google Artifact Registry

GCP service account with read access. Project-and-region scoping preserved during inventory; consolidated into OrbitalReg projects after.

Formats: Docker, Maven, npm, Python, Apt, Yum, Kubeflow

gcr.io legacy registries also supported via the Docker-format adapter.

Migrating from cloud-native registries — step-by-step guide ↗

What gets migrated

The five formats that matter most — plus thirty-seven more.

Most teams move a small number of formats with high volume. We profile the migration around your top-five and pull the long-tail formats during the same window.

Maven

pom.xml + sha + signature stay intact. Snapshot vs release semantics preserved.

npm

package.json metadata + .tgz tarball + integrity hash. Scoped packages map naturally.

Docker

Image manifests + layers + tags + signatures. Multi-arch index.json supported.

Helm

index.yaml + tarballs + signed Chart.yaml provenance.

PyPI

Wheels + sdists + metadata. Per-project namespace mapping.

Plus 30+ additional adapters — Cargo, RubyGems, NuGet, Conan, Nix, Argo Workflows, Deno, Homebrew, Ollama, Kustomize, OPA Bundles, and more. The full format support matrix is in the documentation.

How migration works

Three strategies. You pick the risk profile.

We've helped teams migrate registries from a few GB to multiple TB. The right approach depends on your downtime tolerance, your registry size, and how distributed your developer base is.

01

Big bang

Schedule a maintenance window. Run inventory + bulk import + verify. Flip DNS. Total downtime: 30 min – 4 h depending on registry size.

Best for: smaller registries (< 1 TB), teams that can afford a planned outage, predictability over zero-downtime.

02

Blue-green parallel run

OrbitalReg runs alongside the source registry. Push traffic doubles up; pull traffic stays on source. After full inventory + verification, you flip DNS in a single change.

Best for: production-critical registries, zero-downtime requirement, ability to handle 2× write traffic during the cutover window.

03

Lazy proxy

OrbitalReg starts as a remote-proxy in front of the source registry. Each pull fills the cache. Once cache hits exceed your threshold, switch to local-only mode and decommission the source.

Best for: huge registries (> 10 TB), low risk tolerance, distributed teams that can't agree on a single cutover window.

Verify before you cut over

The orbital migrate CLI.

A single command-line tool plans the inventory, runs the import, and verifies the result against the source registry — sample-set sha256 comparison, format-aware metadata diffing, permission audit.

Cutover is your decision; the verifier tells you when the data says the cutover is safe.

Reference: plan · apply · verify · finalize · orbital migrate 

# Inventory the source registry
$ orbital migrate plan \
    --source nexus \
    --endpoint https://nexus.example.com \
    --token $NEXUS_TOKEN
✓ 12 projects, 100 repositories, ~30M artifacts (14.2 TB)
✓ Strategy recommendation: lazy proxy (size class: large)
✓ Estimated cutover window: 7-14 days (gradual)

# Run the bulk import (resumable, parallel)
$ orbital migrate apply --plan migration-plan.json
✓ 100/100 repositories registered
✓ 30,184,572 artifacts indexed
✓ 47 permission groups translated
✓ Lazy-proxy mode: pulls fill cache on demand

# Verify before cutover
$ orbital migrate verify --sample 5000
✓ 5000/5000 sha256 matches
✓ All metadata round-trips correctly
✓ Pull-test from random sample succeeded
→ Safe to flip DNS

Questions

What teams ask before an Artifactory or Nexus migration.

How long does a migration from JFrog Artifactory or Sonatype Nexus take?

It depends on registry size and the strategy you pick. A big-bang cutover of a registry under 1 TB fits a 30-minute to 4-hour maintenance window. A blue-green parallel run has no downtime and usually completes within days. The lazy-proxy strategy for registries above 10 TB runs for one to two weeks while the cache fills, with no single cutover moment. orbital migrate plan reports the size class and recommends a strategy before anything is copied.

Can I migrate from Nexus or Artifactory to OrbitalReg without downtime?

Yes. In the blue-green strategy OrbitalReg runs alongside the source registry: pushes go to both, pulls stay on the source until orbital migrate verify confirms sha256 matches on a sample set, then DNS flips in one change. In the lazy-proxy strategy OrbitalReg fronts the old registry as a remote proxy and fills its cache on demand, so developers never notice a switch.

What happens to Xray policies, Nexus roles and repository permissions?

JFrog Xray watches and policies map to OrbitalReg pull-gate policies. Nexus repository-level permissions, GitHub team mappings, GitLab group and project scopes and Azure feed permissions translate to OrbitalReg projects and roles during the inventory pass, and orbital migrate verify includes a permission audit before cutover.

Do my developers have to change their build configuration?

Only the registry URL. OrbitalReg speaks the native protocol of each format — Maven, npm, PyPI, Docker/OCI, Helm, NuGet, Cargo and 35 more — so pom.xml, .npmrc, pip.conf, Docker daemon config and Helm repos keep working once they point at the new host. Virtual repositories keep the same layout as Artifactory and Nexus group repositories.

Is the migration tooling included, or an add-on?

Included. The importers and the orbital migrate CLI (plan, apply, verify, finalize) ship in the OrbitalReg core in every tier, including the free version — no separate licence and no third-party migration tool.

Detailed playbooks

The full playbooks are public.

Per-source step-by-step guides, format-by-format gotchas, rollback procedures and the verification CLI's full reference live in the documentation — no signup. Run the 30-day trial next to your current registry and let orbital migrate plan tell you what a cutover would take.

Read the migration guides ↗ Try it free — 30 days →