2026 Remote Mac CI: Artifactory vs Nexus for npm & PyPI proxies

Choose a repository manager only after your compliance boundary is clear: you need immutable audit trails for who requested which tarball, virtual repositories that merge remote caches with internal wheels, and egress allowlists that stop jobs from falling back to the public npm or PyPI CDNs. In multinational orgs, 2026 trends push artifact-first CI: the same platform that stores Docker layers and generic binaries also fronts language registries so FinOps can attribute egress per product line.

On remote Mac pools, prerequisites also include per-job identity (token or mutual TLS per workspace), non-shared default caches unless quotas are proven, and a written policy for yanked packages and license blocks that the proxy enforces before bytes reach APFS. If you cannot operate cleanup windows without colliding with nightly builds, pause expansion of parallel workers until storage SRE signs off.

Both products implement remote plus virtual repositories, negative caching of 404s, and retention policies; differences that matter on CI are operational knobs and how your platform team already monitors them—not marketing checklists.

Neither product removes the need for lockfile discipline: the proxy accelerates trusted graphs; it does not guess which semver range your security team would have approved last Tuesday.

Repository managers hold the durable warm layer; remote Mac jobs still accumulate local caches under the workspace and user caches. Treat these paths as disposable but bounded: point them at APFS with explicit quotas relative to your largest monorepo install.

• npm: ${CI_PROJECT_DIR}/.npm-cache via npm_config_cache; avoid writing under ~/.npm on shared images without per-job subfolders.
• pnpm / Yarn Berry: PNPM_HOME, pnpm store path, or YARN_CACHE_FOLDER under the job directory so concurrent jobs never lock the same global store.
• pip / uv: PIP_CACHE_DIR and UV_CACHE_DIR on fast local disk; large wheels plus Xcode artifacts compete for the same volume.

Cleanup windows: schedule repository garbage collection and compact tasks in off-peak hours for the region where the proxy lives, not where developers sit. On the Mac runner, run a post-job trim when free space crosses a warn threshold (for example 18% free) and hard-fail pre-install when below a stop threshold (for example 12% free) so you never half-write node_modules into a full disk.

Copy the baseline block into your pipeline template, then adjust hostnames and thresholds per environment. Secrets belong in your vault—only hostnames and numeric caps should appear in public logs.

# --- Concurrency (shared remote Mac pool; tune per CPU tier) ---
export NPM_CONFIG_MAXSOCKETS="${NPM_CONFIG_MAXSOCKETS:-12}"       # cap concurrent sockets to registry
export UV_HTTP_TIMEOUT="${UV_HTTP_TIMEOUT:-120}"                  # seconds; raise only after proxy SLA review
export PIP_DEFAULT_TIMEOUT="${PIP_DEFAULT_TIMEOUT:-120}"

# --- Client-side install parallelism (avoid oversubscription) ---
export npm_config_jobs="${npm_config_jobs:-4}"                   # npm lifecycle parallelism hint
# pip: use pip install -q --progress-bar off (no global workers env); cap CI step GNU parallel separately

# --- Disk watermarks (APFS free %; fail fast before install) ---
export MAC_CI_DISK_WARN_PCT="${MAC_CI_DISK_WARN_PCT:-18}"
export MAC_CI_DISK_STOP_PCT="${MAC_CI_DISK_STOP_PCT:-12}"
# Example preflight (macOS): parse `df -g /` free% and exit non-zero if below MAC_CI_DISK_STOP_PCT

# --- Local cache dirs (job-isolated) ---
export npm_config_cache="${CI_PROJECT_DIR}/.npm-cache"
export UV_CACHE_DIR="${CI_PROJECT_DIR}/.uv-cache"
export PIP_CACHE_DIR="${CI_PROJECT_DIR}/.pip-cache"

# --- Repository proxy base URLs (virtual repos only) ---
export NPM_CONFIG_REGISTRY="https://artifactory.example.com/artifactory/api/npm/npm-virtual/"
# PyPI index URL for pip/uv must point at your Nexus or Artifactory PyPI proxy path

# --- Lockfile consistency acceptance (examples; pick one stack) ---
# npm: npm ci && git diff --exit-code package-lock.json
# uv: uv sync --frozen && git diff --exit-code uv.lock

Server-side mirror of the same idea: cap upstream retrieval threads and socket timeouts in Artifactory or Nexus so a single stormy day on the public registry does not translate into hung CI steps. Align those timeouts with UV_HTTP_TIMEOUT and PIP_DEFAULT_TIMEOUT so clients retry or fail consistently instead of dangling.

For Yarn Berry and registry mirrors next to this proxy layer, see the Yarn Berry PnP and registry mirror decision matrix.

Step 1 — Proxy-only resolve: fail the job if any tool resolves against a hostname outside your Artifactory or Nexus virtual hostnames (grep lockfiles and config for stray registry.npmjs.org or pypi.org when policy forbids them).

Step 2 — Lockfile immutability: after install, run git diff --exit-code on the relevant lockfile (package-lock.json, pnpm-lock.yaml, uv.lock, poetry.lock). Frozen installs (npm ci, uv sync --frozen, poetry install --sync where applicable) should never rewrite graphs on clean runners.

Step 3 — Disk and proxy health preflight: assert free APFS percentage, curl the virtual repository health endpoint with a bearer token, and emit repository cache size metrics into your build summary so on-call can correlate spikes with TTL or cleanup misconfiguration.

Can we run both Artifactory and Nexus in parallel for npm? Technically yes, but CI should see exactly one virtual URL per ecosystem to preserve deterministic caches and audit trails. Use the second system only for migration cutovers with explicit dual-write windows.

What breaks first when TTL is too aggressive? Metadata refreshes that hide newly published internal packages, or negative caching that keeps 404s alive longer than developers expect—tune TTL per upstream, not globally.

Does a larger npm maxsockets always speed up cross-border CI? No; beyond the proxy’s comfortable concurrency it increases TLS churn and 429-style throttling. Raise sockets only when the repository tier and Mac pool both show headroom.