Turn any OCI registry into a cross-platform binary distribution platform. Zero extra infrastructure.
Your Docker Hub, GHCR, ECR, or Harbor is the package server. No new infrastructure, no new credentials, no new licenses.
One identifier resolves to the right binary on Linux, macOS, Windows, or FreeBSD. OCI multi-platform manifests handle the rest.
Content-addressed storage deduplicates automatically — if two tags resolve to the same build, they share one copy on disk. A local index snapshot locks every resolution. Same command, same result — today, tomorrow, offline.
JSON output, clean environments, composable commands. Designed from the ground up for CI pipelines and build systems.
One command. Any platform. No root required.
curl -fsSL https://ocx.sh/install.sh | shirm https://ocx.sh/install.ps1 | iexOpen a new terminal and run ocx install uv:0.10 to install your first package.
A closer look at what makes ocx different.
Install packages directly from any OCI-compliant registry. No taps, no formulas, no Artifactory. The same infrastructure you already run for container images now serves your development tools.
One command installs and activates a package. Switch versions instantly. Every install is content-addressed by SHA-256 digest — what you download is what you run.
Think docker pull — but for standalone binaries. You name the package, OCI multi-platform manifests resolve the right build for your OS and architecture. No platform conditionals, no filename guessing, no architecture mapping tables.
Write ocx install uv:0.10 once. It works on your Mac, your CI runner's Linux, and your colleague's Windows machine — the tools you already use, distributed the way containers taught us.
Every package declares its own environment variables. ocx exec layers them on top of your current shell, and with --clean it strips everything back to only what the packages provide — no host pollution, no PATH conflicts, no stale state.
Compose multiple packages in a single invocation. Each one contributes its variables. Pass --clean when you need a hermetic, reproducible scope — ideal for CI pipelines and build systems.
Every object in the store is identified by its SHA-256 digest — a cryptographic fingerprint of its contents. If uv:0.10 and uv:latest resolve to the same build, they share one directory on disk. Storage scales with distinct builds, not with the number of tags pointing at them.
This also means verification is built in. A path under sha256:…/ never changes its contents. Pin any package to a digest and you have a lockfile-free guarantee — no registry queries, no index lookups, just the hash.
Every command returns structured JSON with --format json. Exit codes are meaningful. Environment variables compose cleanly. There is no interactive prompt, no "press Y to continue", no color code that breaks your parser.
ocx exec runs commands with package-declared variables. ocx env prints them for your build system. ocx ci export writes them directly into GitHub Actions or GitLab CI runtime files. The entire CLI is designed to be called by other tools, not typed by humans.
Every install is a self-contained directory — no global state, no registry database, no fragile symlinks into system paths. Copy the store to a USB drive, zip it into a CI cache artifact, or scp it to a machine behind a firewall.
The local index snapshot plus the content-addressed object store is everything ocx --offline needs. Bundle a toolchain once, redistribute it to air-gapped hosts, and ocx install --offline resolves it without ever touching the network.
Join the community and help shape what comes next.
ocx — your registry, your binaries, no extra infrastructure — free to use, fork, and extend.