Files
pnpm/pnpr/docs/installation.md
Zoltan Kochan 7fb2bfab4a docs(pnpr): correct configuration keys, defaults, and commands (#17245)
Part of https://github.com/pnpm/tasks/issues/191.

Wrong claims:
- cli: drop the nonexistent `add-user --password` flag and document the
  terminal/stdin password read; `oci-gc --min-age` and `cache-gc --max-age`
  are the flags (the `-secs` forms are aliases); `--from` defaults to the
  `storage` key, not an internal field; `info` and `http` log the same
  access records; only global and server options have PNPR_* variables.
- configuration: `packumentTtl` defaults to 5m; the minimal config now
  sets `auth.htpasswd.file`, and the auth section says accounts live in
  memory without it or a backend; grouped hosted registries default their
  org to `<ecosystem>~<name>`; the handshake is served for any surface;
  the pipeline surface also satisfies "something must be served"; add
  `package.update_maintainers` to the audit list.
- tls-and-reverse-proxy: remove the invalid `publicUrl:` YAML key and the
  nonexistent `rate_limiting` setting.
- backup-and-restore: `pnpr verify` hashes by default (`--check-hashes`
  does not exist, `--skip-hashes` skips only the hash
  comparison); `migrate-storage
  --verify` compares bytes.
- webhooks: audit events do not cover publishes or token creation; the
  example uses a real action and the `actor` field.
- cli: the `RUST_LOG` example keeps `pnpr::audit=info`.
- install-acceleration: the `--public-url` host is exempt from the
  private-address refusal.
- shared-side-effects-cache: `pnpm pipeline` publishes workspace-task
  artifacts.

Missing facts: `routes.allowedPrivateNetworks`, the upstream `search` key
and canonical `maxAge`, built-in `npm.jsr.io` route, relative path
resolution, `log` defaults and `type`, `${VAR:-default}` substitution and
the full secret-field list, `oci` defaults, `artifacts.quota` bounds,
`migrate-storage` destination rules, `--osv false`, `--packument-ttl`
default, S3 `forcePathStyle`/`allowHttp` defaults, grouped org layout,
OIDC key table, container image section, `backend:` ignoring the htpasswd
and token files.

Duplicates and links: health probe bodies, reload procedure, and the
resolver allowlist now link to their one home; broken `#secret` anchor
fixed; links into the pnpm docs use absolute pnpm.io URLs.

Stale history: drop "pnpr v1" and the per-paragraph "Since alpha.N" /
"Since pnpm 12.x" prefixes, and the contributor-only extensibility text.

Also corrects the `as_filter_directive` doc comment, which claimed `http`
quiets the rest of the crate.
2026-10-23 00:11:00 +02:00

1.9 KiB

id, title
id title
installation Installation

pnpr is distributed on npm as @pnpm/pnpr. The npm wrapper requires Node.js 18 or newer. Install it globally:

pnpm add -g @pnpm/pnpr@next

Until the first stable release, every pnpr version is a prerelease published under the next dist-tag, so install @pnpm/pnpr@next.

The wrapper package resolves to the native binary published under @pnpm/pnpr.<platform>-<arch> (e.g. @pnpm/pnpr.linux-x64). Prebuilt binaries are available for:

  • linux-x64, linux-arm64
  • linux-x64-musl, linux-arm64-musl
  • darwin-x64, darwin-arm64
  • win32-x64, win32-arm64

Only the binary matching your platform is downloaded.

Container image

pnpr is also published as the ghcr.io/pnpm/pnpr container image:

docker run -p 127.0.0.1:7677:7677 -v pnpr-storage:/pnpr/storage ghcr.io/pnpm/pnpr:<version>
  • The entrypoint is pnpr. Arguments after the image name replace the default command, serve --listen 0.0.0.0:7677 --storage /pnpr/storage --cache /pnpr/cache.

  • /pnpr/storage and /pnpr/cache are volumes. Only /pnpr/storage holds data that must survive.

  • The default command passes --storage /pnpr/storage, so the bundled config keeps htpasswd and tokens.db in that volume. Pass the same flag when you replace the command, for example to create an account:

    docker run --rm -it -v pnpr-storage:/pnpr/storage ghcr.io/pnpm/pnpr:<version> add-user alice --storage /pnpr/storage
    
  • The server runs as the non-root pnpr user.

  • The example publishes the port on loopback only. pnpr serves plain HTTP, so put a TLS-terminating proxy in front before clients on other machines log in.

Verify the installation

pnpr --version

Next steps

Continue to the Quick start to run the server and point a client at it.