GitLab Package Registry (generic / npm / Maven / PyPI / NuGet / Conan)
- Free allowance
- Explicitly EXCLUDED from the project storage quota.
- Verdict
- ★ qualifiesusable as stated; the read path was probed
- Cost
- free tier
- Identity
- institutionno card, no phone
- Binding limit
- per-object-cap5 GB per file
- Evidence
- reported5 sources; a third party said so
- Freshness
- stale on 2026-11-05checked 2026-10-21 (inherited); stale on 2026-11-05
| Free tier | Explicitly EXCLUDED from the project storage quota. GitLab docs, verbatim: 'GitLab projects have a storage limit for their Git repository and Large File Storage (LFS). Only the project's repository and LFS are included in the storage limit. The container registry, package registry, and build artifacts are not included in the limit.' The 10 GiB figure (pricing page: 'Storage 10 GiB') therefore applies only to git+LFS; package bytes are unquota'd. Per-file ceilings: Generic 5 GB, npm 5 GB, Maven 5 GB, NuGet 5 GB, PyPI 5 GB, Conan 5 GB, Terraform 1 GB, ML model 10 GB (uploads capped at 5 GB), Helm 5 MB. unit GiB; metered on stored-bytes |
|---|---|
| Price | none stated |
| Limits |
5 GB per file (generic). Package registry rate limits apply to the Packages API. Authenticated API traffic 2,000 req/min per user; unauthenticated 60 req/hr per IP. Project creation 200/day/user. No per-project package storage cap documented. |
| Binding | per-object-cap the per-object cap sets the shard size and therefore the object count; it bounds the total more tightly than any headline quota |
| Identity | institution not published |
| Egress | Free and unmetered for downloads; no egress line item anywhere in GitLab pricing. Served through Cloudflare (probe returned Server: cloudflare). |
| Per-object cap | 5 GB per file (5000000000 bytes) |
| Retention | not stated |
| Interface | rest, rclone rest |
| Tooling | Full REST API: PUT /api/v4/projects/:id/packages/generic/:package_name/:version/:file_name and GET the same path for download. Also native npm/maven/pypi/nuget/conan clients by pointing a user at the GitLab URL. No rclone backend, but the generic-package PUT/GET is a two-verb blob API — trivial to drive from curl or a 30-line Python loop. Deploy tokens with write_package_registry scope give scoped push credentials. |
| Composes with | UNBOUNDED on two axes: (a) unlimited free projects per account (GitLab Free has no project cap; only project *creation rate* is limited to 200/day/user) x 5 GB per file x unlimited files per project; (b) package bytes sit outside the 10 GiB quota entirely, so a single project is already a de-facto unlimited bucket and additional projects multiply it further. |
| Reliability | Package registry is a real feature not a cache — no TTL, but a project cleanup policy can auto-delete package assets if configured, so leave it off. Anonymous pull must be enabled per project ('Allow anyone to pull from package registry'). NuGet group endpoints refuse anonymous pulls entirely. |
| Parsed numbers |
|
Evidence 5
| date | source | what it proved |
|---|---|---|
| 2026-10-21 | docs.gitlab.com/user/storage_usage_quotas/ | 'the container registry, package registry, and build artifacts are not included in the limit'; 'Each project in a Free tier namespace on GitLab.com has 10 GiB of free storage' |
| 2026-10-21 | docs.gitlab.com/user/gitlab_com/ | per-format max file size table (Generic 5 GB, npm 5 GB, ML model 10 GB) |
| 2026-10-21 | gitlab.com/api/v4/projects/34675721/packages/generic/glab/1. | probe: GET (no auth) -> 200 OK, Content-Length: 9035444, Content-Type: application/gzip, Server: cloudflare |
| 2026-10-21 | gitlab.com/api/v4/projects/gitlab-org%2Fcli/packages | probe: GET (no auth) -> 200 OK, JSON listing packages |
| 2026-10-21 | docs.gitlab.com/user/packages/generic_packages/ | 'To interact with the package registry, you must authenticate' for upload; download paths documented as GET |
Unknown values 4
$.identity_cost.detailboilerplate$.per_object_cap.notesthe field may be stated in a source that was not read$.retention.notesthe field may be stated in a source that was not read$.retention.statedthe field may be stated in a source that was not read