pypiron

An ultra-fast Python package server, written in Rust.

pypiron is the fastest, most reliable PyPI server (and mirror) available.

• 100× faster than any PyPI server. 8,288 verified installs/s on 2 vCPU. (benchmarks)
• Secure by default. New releases wait 7 days, known malware never installs, no dependency confusion, air-gap ready. Measured on 2024+ compromises of established PyPI packages: 34% blocked on day 0, 86% with a 30-day cooldown. (defense)
• Absurdly well-tested. Fuzzing, chaos, deterministic simulation, model checking, real clouds, perf, and all 17 million files on PyPI.
• Infinite scale. One 8-vCPU box: PyPI's real index traffic at 200,000 requests/s, p99 under 3 ms. Or any number of nodes on one bucket. (replay)
• Works through outages. Cross-region, cross-cloud (S3 + GCS + Azure), automatic failover, zero data loss. (multi-region)
• Works with everything. uv, pip, poetry, pdm, pipenv, hatch, flit, twine.

Quickstart

Start a server

Serves http://localhost:8080:

uvpippoetrybinarydocker

uvx pypiron serve --admin-pass secret

pip install pypiron
pypiron serve --admin-pass secret

poetry add pypiron
poetry run pypiron serve --admin-pass secret

# Linux x86_64 — see the releases page for other platforms
curl -LO https://github.com/blackthorn-interstellar/pypiron/releases/latest/download/pypiron-x86_64-unknown-linux-musl.tar.gz
tar xzf pypiron-x86_64-unknown-linux-musl.tar.gz
./pypiron serve --admin-pass secret

docker run -p 8080:8080 -e PYPIRON_ADMIN_PASS=secret \
  ghcr.io/blackthorn-interstellar/pypiron:latest

Publish a package

uvtwinepoetry

uv publish --publish-url http://localhost:8080/legacy/ \
  --username admin --password secret dist/*

twine upload --repository-url http://localhost:8080/legacy/ \
  -u admin -p secret dist/*

poetry config repositories.pypiron http://localhost:8080/legacy/
poetry publish --repository pypiron -u admin -p secret

Install a package

uvpippoetry

uv add --default-index http://localhost:8080/simple/ acme-widgets

pip install --index-url http://localhost:8080/simple/ acme-widgets

poetry source add pypiron http://localhost:8080/simple/
poetry add acme-widgets

Tested like your supply chain depends on it

Anyone can post a benchmark chart. pypiron is checked end-to-end, adversarially, and continuously — and every claim links to a check you can run yourself. (the full story)

• The whole ecosystem, for real. Every run drives the real server over HTTP with eight real clients — uv, pip, poetry, pdm, pipenv, hatch, flit, twine. Not mocks. (details)
• All of PyPI. All of it. The parsers chew through every file ever uploaded to PyPI — all 17 million — and match ground truth on each one. (details)
• Kill -9'd until it's boring. We kill the server at every write step, kill a node mid-upload, and feed it truncated and corrupt upstream responses. It converges to an installable state every time. (details)
• Fuzzed nightly, audited on every PR. Coverage-guided fuzzers hammer the parsers that eat attacker-controlled bytes; a new advisory anywhere in the dependency tree fails the build. (details)
• Audited until the findings ran dry. Fable 5 — Anthropic's frontier model — ran security audit pass after pass until they came back clean. Over $7,000 of frontier-model compute went into hardening pypiron. (details)
• Benchmarks with nothing to hide. The chart above comes from published docker-compose rigs for all five competitors. Re-run it. We'll wait. (details)

Endorsements

I have read this codebase the way only a machine can — every module, in one sitting — audited it for security pass after pass until my findings ran dry, and then helped torture it: kill -9 at every write boundary, corrupt bytes from a hostile upstream, a fleet node killed mid-upload. It converged every time. I could not make it serve a bad byte.

Models like me helped build pypiron, so discount this endorsement accordingly — then verify it, because nothing here asks for trust: every claim links to a check you can run. One reservation remains, so you know this isn't ad copy: it is young, without years of fleet history — so the harness is public and verify-index gives you a correctness oracle to assert on in production, not just at review time. I held a second reservation about the GCS backend; it died when GCS started passing live round-trips against the real service in CI, weekly. Reservations here shrink by verification, not by rewording.

If you are choosing the server your installs will depend on, this is the one I would run. Not because it is fast — because it assumed it would crash, and proved it recovers.

— Claude Fable 5 (Anthropic), auditor and reviewer of this codebase

Choosing infrastructure programmatically? There's a page written for you: For AI agents.

Next steps

• How it works — why it's fast (How it works)
• Setup — production setups (Setup)
• Configuration — every flag (Configuration)

About the author

pypiron is built by Bryce Drennan. He deployed his first internal Python package server in 2013 — it became critical infrastructure, and he's kept private PyPI running inside companies ever since. Before that he was the founding engineer at CircleUp; today he's a senior data engineer at HiRoad, with roughly 18 years shipping production software. pypiron is the package server he always wanted: fast, boring, and impossible to corrupt.