Your build cache shouldn't die with its vendor.
FosterStack is a self-hosted remote build cache server — a Develocity Build Cache Node replacement that speaks the same Gradle remote build cache HTTP protocol, so migrating is mostly a URL change. The same server implements the Apache Maven Build Cache Extension's remote HTTP mode (Maven acceptance coverage is in progress), so a mixed Gradle and Maven shop runs one deploy instead of two. Open source core, one-command deploy, and the thing that matters: it stays patched, on a promise.
Try it now
There is no signup, no waitlist, and no license key for the free tier. Pull the image and point your build at it:
docker run -d -p 8080:8080 ghcr.io/fosterstack/cache:latest
curl localhost:8080/healthz # -> okQuickstart Migrate off Build Cache Node Read the source
Where it stands: v0.1 — early. The cache core and HTTP surface are tested, and the Gradle path is acceptance-tested against a real multi-module build in CI; the release pipeline works and its evidence chain is being rebuilt — the repository's SECURITY.md states exactly what is and is not proven today. Nobody is running it in a production build pipeline yet except us. Bugs and questions go to GitHub issues, which is also where the roadmap gets argued with.
Stay in touch
We do not collect email addresses. To follow the project, star the repository or use Watch → Custom → Releases on GitHub — that notifies you on a new release and nothing else, and it is a subscription you control and can revoke without asking us.
What you get that a bare HTTP endpoint doesn't give you
Yes — Gradle's remote cache protocol is just GET and PUT, and you could point it at any object store. What you'd be rebuilding yourself is everything around that:
Cache management
Size-capped LRU eviction that keeps a busy CI cache healthy without hand-tending — set the cap, and the oldest-unused entries make room.
Authentication
HTTP Basic Auth over TLS, wired the way Gradle and Maven already expect credentials. Constant-time comparison, no credential ever logged.
Metrics & status
Prometheus metrics, a read-only status page with hit rates and size-vs-cap, and a Grafana dashboard in the repo — so you know the cache is earning its keep.
Maintenance target
Dependency CVEs remediated fast — target within 48 hours of disclosure. A stated intention until the paid tiers exist, and the release history is the track record either way.
Acceptance-tested
Every change runs against a real multi-module Gradle build in CI: a from-scratch second build must produce real remote-cache hits, or the change does not merge.
30-minute migration
A step-by-step guide for existing Build Cache Node deployments. Same protocol, same CI config shape — migrating is mostly a URL change.
Built to be verified, not trusted
We're a new vendor asking to sit in your build pipeline, so the burden of proof is on us. The answer is to make everything checkable:
- MIT-licensed core. Read the code before you run it.
- One public container image. Free and paid users pull the identical bytes — scan exactly what you deploy.
- When the paid tiers ship, a license key will unlock them in the same public image — no private registry, no gated downloads. (They are not built yet; the pricing below is direction, not a shelf.)
- Security patches are never withheld from the free tier. Not delayed, not embargoed — never.
- Signed commits, signed releases, public release notes. The repository's SECURITY.md states exactly what the release evidence does and does not prove today.
What we do not collect
- The product does not phone home. The server makes no outbound network connections — no telemetry, no license check, no update ping. It is self-hosted, and it works identically on a machine with no route to the internet. Verified rather than asserted: the binary opens exactly one socket, its own listener, at rest and under load.
- This website collects no email addresses. There is no signup form, no waitlist, and no newsletter. It sets no cookies, runs no analytics, and loads nothing from a third party.
- The only personal data FosterStack LLC holds is the irreducible minimum required to bill a paying customer — handled by Stripe — and whatever you voluntarily put in an email to support. See §2 of the terms of service.
Deliberately not claiming "we never collect any personal data": billing a customer requires an email address, and a privacy claim that is convenient but false is worse than none.
Pricing
| Free | Team | Business |
|---|---|---|
| The full cache server, MIT-licensed, self-hosted. Forever free. | $49/month — access control, metrics UI, email support. | $199/month — SSO, HA/replication, analytics, priority support with the CVE-response SLA. |
Self-serve, credit card, cancel anytime. Priced so an engineering manager can expense it without a procurement cycle — the incumbent's median contract runs $57k/year.
Roadmap honesty
Gradle and Maven both run against the same server today; we maintain the cache server, while the Maven client side is Apache's own Build Cache Extension. An npm remote cache for CI — same core, a third protocol — is the next protocol on the list. What is not on the list yet is a Helm chart and the paid tiers below; those are described so you know where this is going, not sold as available. If you need something sooner, open an issue — that is what moves the roadmap.