Repo brief: SUSE/Portus

Generated by RepoPilot · document generated 2026-09-14 · concise human review Evidence snapshot · analyzed 2026-09-14T20:33:25.223Z · commit 284343774251

Verdict

Mixed — Stale — last commit 4y ago

• 6 active contributors
• Apache-2.0 licensed
• CI configured
• Tests present

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against OpenSSF Scorecard

What it is

Portus is an authorization server and web UI for Docker Registry v2 that implements token-based authentication and fine-grained access control. It allows Docker registry operators to manage users, teams, and per-namespace permissions without relying on third-party services, while providing a dashboard to browse available images and tags according to user privileges. Rails monolith with a Vue.js frontend: app/assets/javascripts/ contains modular Vue components organized by feature (admin/registries, namespaces, explore, dashboard), app/assets/images/ holds UI assets, and the backend appears to be in app/ (typical Rails layout). Each frontend module (e.g., modules/namespaces/) has…

Start here

Read these in order:

• app/assets/javascripts/polyfill.js — Foundation: doesn't import anything internally and is imported by 2 other files. Read first to learn the vocabulary.
• app/assets/javascripts/utils/alert.js — Foundation: imported by 1, no internal dependencies of its own.
• app/assets/javascripts/bootstrap.js — Built on the foundation; imported by 2 downstream files.
• app/assets/javascripts/modules/users/pages/legacy/edit.js — Built on the foundation; imported by 1 downstream file.
• app/assets/javascripts/modules/dashboard/index.js — Layer 2 — application-level code that wires the lower layers together.

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

Clone the repository:

git clone https://github.com/SUSE/Portus.git
cd Portus

No Gemfile or package.json snippets are visible in the provided data. Verify the repository for a Gemfile (Ruby) and package.json (Node.js for frontend assets), then run bundle install && npm install (or yarn). See re…

Daily commands:

Exact dev startup commands are not visible in the provided snippet. Typically for a Rails + Vue app: bundle install, set up config/database.yml and environment variables (Registry endpoint, auth config), run `rails db…

…shortened for this brief.

Key cautions & unknowns

• Stale — last commit 4y ago
• Concentrated ownership — top contributor handles 71% of recent commits
• Scorecard: marked unmaintained (0/10)
• Docker Registry v2 endpoint (URL, credentials) must be configured before Portus can sync images—this is not a standalone service. Token-based auth assumes the Registry is configured to accept tokens from this Portus…
• Published-advisory coverage was unavailable for the captured dependencies.
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests
• OpenSSF Scorecard

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.