Overview

Bifrost is a dependency-download management system built for organizations that can't just docker pull or pip install from the open internet — regulated, restricted, or fully air-gapped environments.

Its job is to move approved third-party artifacts (container images, Maven and npm packages, Python wheels, Helm charts, files, website mirrors, and Hugging Face models) from the open internet into a network that's deliberately cut off from it, without giving that network a hole straight back out.

The pieces

Bifrost is a small set of cooperating services, not a single binary:

• Orchestrator API — the control plane. Accepts download requests and schedules, tracks job status, and exposes the REST surface (/downloads, /schedules, /auth) that a frontend or CI pipeline talks to.
• Minion workers — do the actual fetching. Each Minion understands a family of package ecosystems (Docker, Maven, Python, npm, Helm, files, websites, Hugging Face) and reports job status back over a queue.
• Message queue — decouples the orchestrator from the workers, so requests keep flowing even while a large download is in progress.
• The bridge — the part that actually crosses the air gap. This is covered in depth in Architecture & deployment models.
• Auth — OAuth2/OIDC-backed, so every download request and every scheduled job is tied to an identity, not just a network path.

Where to go next

• Architecture & deployment models — the range of air-gap and restricted-network topologies Bifrost is built to support.
• Deployment — Docker Compose — the fastest way to run the full stack locally.
• Concepts — a short glossary if the Orchestrator/Minion/bridge terminology above is new.

Bifrost is pre-1.0 and under active development — expect this documentation to grow alongside it, particularly the Helm chart deployment guide.