We build tools that help you secure your build pipeline. It made sense to start with the build cache. We built FosterStack Cache by meticulously following the security guidance that matters: CISA Secure by Design, NIST SP 800-204C and 800-204D, and SLSA. Where the guidance stops, we kept going: hermetic, reproducible builds, a distroless image, and more. Read the full list.
Fast builds from cache are worth keeping.
FosterStack is a self-hosted remote build cache server — a Develocity Build Cache Node replacement that speaks the same Gradle remote build cache HTTP protocol, so migrating is mostly a URL change. The same server implements the Apache Maven Build Cache Extension's remote HTTP mode, so a mixed Gradle and Maven shop runs one deploy instead of two. Open source core, one-command deploy, and the thing that matters: it stays patched, on a promise.
Try it now
There is no signup, no waitlist, and no license key for the free tier. Pull the image and point your build at it:
docker run -d -p 8080:8080 ghcr.io/fosterstack/cache:latest
curl localhost:8080/healthz # -> okQuickstart Migrate off Build Cache Node Read the source
Bugs and questions go to GitHub issues, which is also where the roadmap is settled.
What you get that a bare HTTP endpoint doesn't give you
Yes — Gradle's remote cache protocol is just GET and PUT, and you could point it at any object store. What you'd be rebuilding yourself is everything around that:
Cache management
Size-capped LRU eviction that keeps a busy CI cache healthy without hand-tending — set the cap, and the oldest-unused entries make room.
Authentication
HTTP Basic Auth over TLS, wired the way Gradle and Maven already expect credentials. Constant-time comparison, no credential ever logged.
Metrics & status
Prometheus metrics, a read-only status page with hit rates and size-vs-cap, and a Grafana dashboard in the repo — so you know the cache is earning its keep.
30-minute migration
A step-by-step guide for existing Build Cache Node deployments. Same protocol, same CI config shape — migrating is mostly a URL change.
Verify every release
Every step of our release produces signed provenance. When a FosterStack signature verifies, you know it's FosterStack code, a FosterStack build and a FosterStack image, and everything in between. See how each stage maps.
Air-gapped ready
No telemetry. Nothing outbound. It runs the same air-gapped.
Pricing
Per product. Free is the full product.
Paid tiers are coming; checkout isn't open yet.
| Free | Team | Business | Compliance |
|---|---|---|---|
The full cache server, MIT-licensed, self-hosted. Every security patch, the
-fips image, and all release evidence, free. |
$49/month — multi-user access control, SSO (OIDC), per-project usage analytics, email support (1-business-day target). | $199/month — everything in Team, plus HA/replication and priority support with the CVE-response target. | $499/month, billed annually — everything in Business, plus the FIPS 140-3 applicability statement, signed per-release attestation letters addressed to you, and security-questionnaire support up to 8 hours per year (async). Who this is for. |
No sales call. No per-seat tax. No enterprise pricing mystery.
Guides
Start here
- Your first 15 minutes with a self-hosted build cache
- Migrate from Build Cache Node
- Build Cache Node end of life
Run it
- Production build cache: Docker Compose, nginx and TLS
- Gradle build cache on Kubernetes
- Install on an air-gapped network