Speed up your CI/CD pipelines by caching build & runtime artifacts By Thijs Feryn 

Your software supply chain has never been more critical 

Modern software is composed & assembled, not written from scratch 

No content

The list goes on and on 

Modern software delivery is automated & orchestrated 

More artifacts than ever ✓ Microservices ✓ Developer sprawl ✓ CI/CD ✓ Agentic AI 

Organizations depend on artifact registries 

No content

No content

Their availability, performance, security & integrity make or break the software supply chain 

https://xkcd.com/303/ 

Your software supply chain has never been under more pressure 

Rate limits 

Rate limits & outages. Slow GitHub Actions pipelines. 

License cost, egress charges, scalability issues 

Cloud outages impact availability of registries 

More commits, more PRs, more builds, more artifact fetches, more API calls 

No content

An update on GitHub availability The main driver is a rapid change in how software is being built. Since the second half of December 2025, agentic development workflows have accelerated sharply. By nearly every measure, the direction is already clear: repository creation, pull request activity, API usage, automation, and large-repository workloads are all growing quickly. https://github.blog/news-insights/company-news/an-update-on-github-availability/ 

Challenging 

Hi, I'm Thijs 

No content

No content

User Varnish Server 

CI/CD Varnish Registry 

– 20 40% of total CI/CD pipeline time consumed by dependency downloads 

Why cache artifacts? ✓ Faster delivery ✓ Scalability ✓ Cost reduction ✓ Resilience 

Varnish Virtual Registry 

No content

https://varni.sh/vvr 

$ docker run -p 80:80 varnish/orca 

$ helm install varnish-orca -f values.yaml oci://docker.io/ varnish/orca-chart 

varnish: http: - port: 80 virtual_registry: config.yaml registries: - name: docker default: true remotes: - url: https://docker.io - name: pypi remotes: - url: https://pypi.org/simple - name: npm remotes: - url: https://registry.npmjs.org 

Using Varnish Virtual Registry docker pull docker.localhost/library/ubuntu npm install express --registry=http://npm.localhost GOPROXY=http://go.localhost go mod tidy helm pull oci://ghcr.localhost/prometheus-community/ charts/prometheus --plain-http git clone http://github.localhost/varnish/varnish.git 

Hyperlocalization 

Cache miss $ time docker pull docker.localhost/library/node:latest latest: Pulling from library/node 635135721e54: Pull complete f28313c8eaf1: Pull complete 39feea71264a: Pull complete 2882152811f6: Pull complete fd264eb324d0: Pull complete 203fdd9313dd: Pull complete c2f1a73884c0: Pull complete Digest: sha256:e3ffe0cbaeebdcddbfe1ee7bca9b564a92863a8386d5b99a3d72677b3667b61d Status: Downloaded newer image for docker.localhost/library/node:latest docker.localhost/library/node:latest What's next: View a summary of image vulnerabilities and recommendations → docker scout quickview docker.localhost/library/node:latest docker pull docker.localhost/library/node:latest 0,22s user 0,28s system 0% cpu 1:29,97 total 

Cache hit $ time docker pull docker.localhost/library/node:latest latest: Pulling from library/node 635135721e54: Pull complete f28313c8eaf1: Pull complete 39feea71264a: Pull complete 2882152811f6: Pull complete fd264eb324d0: Pull complete 203fdd9313dd: Pull complete c2f1a73884c0: Pull complete Digest: sha256:e3ffe0cbaeebdcddbfe1ee7bca9b564a92863a8386d5b99a3d72677b3667b61d Status: Downloaded newer image for docker.localhost/library/node:latest docker.localhost/library/node:latest What's next: View a summary of image vulnerabilities and recommendations → docker scout quickview docker.localhost/library/node:latest docker pull docker.localhost/library/node:latest 0,11s user 0,13s system 1% cpu 12,727 total 

Direct Virtual Registry 1a48a960533f: 15,000 seconds ccd9dba13ae3: 22,000 seconds ed179c6fab21: 23,000 seconds 8dbc42934ae5: 32,000 seconds 7c56d6189d74: 32,000 seconds afa9d872ae23: 53,000 seconds 509699aefca8: 78,000 seconds 1a48a960533f: 0,000 seconds ccd9dba13ae3: 0,000 seconds ed179c6fab21: 1,000 seconds 8dbc42934ae5: 0,000 seconds 7c56d6189d74: 1,000 seconds afa9d872ae23: 1,000 seconds 509699aefca8: 1,000 seconds Sum of individual layer times: 255,000 seconds Wall-clock until all downloads complete: 78,000 seconds Sum of individual layer times: 4,000 seconds Wall-clock until all downloads complete: 1,000 seconds 

No content

$2M cost reduction 

Reduce developer wait time 15 min 3 min Daily wait time saved per developer by caching artifacts in the CI/CD pipeline 

Virtual Registry capabilities Artifact-aware acceleration Authentication preservation Multi-registry routing Observability Origin shielding Failover Persistence Security 

Your software supply chain has never been more vulnerable 

Trusted registries deliver compromised packages 

- - 2026 Software Supply Chain Attacks ✓ 20 40 major Supply Chain Campaigns ✓ 20,000+ malicious packages were discovered ✓ 1000+ packages were directly compromised in high-profile incidents ✓ 10 20 million estimated malicious packages were downloaded 

https://www.codeant.ai/blogs/shai-hulud-npm-supply-chain-attack 

No content

Artifact Firewall 

Enforcement at request time 

No content

$ npm install faker-js --registry=http://npm.localhost --prefer-online npm error code E403 npm error 403 403 Forbidden - GET http://npm.localhost/faker-js - package blocked by firewall (rule "faker-npm", ruleset "my-ruleset") npm error 403 In most cases, you or one of your dependencies are requesting npm error 403 a package version that is forbidden by your security policy, or npm error 403 on a server you do not have access to. 

https://varni.sh/vaf 

https://varni.sh/vvr 

No content

Meet us outside