FosterStack Cache FAQ

Short answers, each with a link to the page that has the detail.

What is FosterStack Cache?

A self-hosted remote build cache for Gradle, and for Maven through the Apache Maven Build Cache Extension. It ships as one static binary or a distroless container image, under the MIT licence. See the first 15 minutes.

Which Gradle and Maven setups does it work with?

Gradle talks to it with its normal remote build cache setting, so the change is mostly a URL. Maven works through Apache's Build Cache Extension. Our CI builds a real multi-module project with each and checks that the second build restores from the remote cache. See Maven setup and GitHub Actions.

Does it work with Jenkins and other CI systems?

Any runner that can reach the server can use it. It is a plain web server. See Jenkins and CI build cache.

How do I move from the free Build Cache Node?

Start the new server empty and point your builds at it. A build cache only holds results your build can rebuild, so there is nothing to copy. See the migration guide and what the end of life means.

Is it free?

Yes. Everything you can download today is the free MIT core, including eviction, size limits and metrics. Paid tiers are coming; checkout isn't open yet. See pricing.

What happens if the cache is down or empty?

Builds are slower, not wrong. Gradle and Maven rebuild what they cannot restore. See what happens when the server is down.

Who can write to the cache?

Anyone holding the read-write password. Turn on Basic Auth anywhere untrusted people could reach the port. You can also set a read-only login that can read but never write. See CI writes, developers read.

Can someone poison our shared cache?

Only someone who can write to it, so the write login is the control. Read Can someone poison our build cache? for what to restrict.

How do I know a release is the real one?

Every image is keylessly signed, and every binary archive is covered by a signed checksums file. Both carry SLSA provenance. No account is needed. See Verify a release.

Does it send anything out?

No. The server sends no telemetry and needs no connection to FosterStack. It can run on a network with no route to the internet. See air-gapped install.

How are security fixes handled?

The current release's images are rescanned daily, so a vulnerability disclosed against bytes we already shipped raises an issue. The policy is in SECURITY.md, and everything we do for security lists the practices.

Can I run it on Kubernetes or Docker?

Yes. Docker and Kubernetes guides are public, with plain manifests for Kubernetes. There is no Helm chart. See Kubernetes and Docker Compose with TLS.

Where do I report a problem or ask for something?

Open an issue on GitHub. There is no signup, form or mailing list.