Packages·3 min read
Packages, explained
What a package is, what a registry does, and how Zaryn hosts packages for Rust, Zig, JavaScript, Python and containers, in plain words. Start here if you have never published one.
A **package** is a piece of code packed up so other people (or your other projects) can use it with one command. Instead of copying files around, you *publish* the package once, and anyone can *install* it by name.
A **package manager** is the tool that does the installing: `cargo` for Rust, `zig` for Zig, `npm` for JavaScript, `pip` for Python, `docker` for container images. A **registry** is the place the package manager downloads from. Zaryn is a registry for all of them, so you keep using the tool you know and only tell it where Zaryn is.
## Which guide do I need?
| You write… | You use… | Guide |
|---|---|---|
| Rust | `cargo` | [Rust packages (crates)](/docs/en/packages-rust) |
| Zig | `zig fetch`, `zig build` | [Zig packages](/docs/en/packages-zig) |
| JavaScript or TypeScript | `npm`, `pnpm`, `yarn` | [npm packages](/docs/en/packages-npm) |
| Python | `pip`, `twine`, `uv` | [Python packages](/docs/en/packages-pypi) |
| Apps in containers | `docker`, `podman`, `helm` | [Container images](/docs/en/packages-containers) |
| Anything else (a program, a dataset) | `curl` | [Any file](/docs/en/packages-files) |
Every guide has the same parts: set up once, publish, install, and what to do when something goes wrong. On the [Packages](/packages) page, the small **?** link next to each command opens the right guide.
## Installing from pypi.org, npm, crates.io or GitHub is slow
That's what Zaryn's **mirrors** are for: pip, uv, npm, cargo, rustup and zig download through Zaryn instead (`zev mirror on` sets them all up), and every file is checked against a checksum your tools already know, so the mirror can't change anything. See [Mirrors](/docs/en/package-mirrors).
## Words you'll see
- **Version.** Every publish has a version number like `1.4.2`. A published version never changes: to fix something, publish `1.4.3`. That's what lets everyone trust that `1.4.2` today is the same as `1.4.2` next year.
- **Hash** (or **checksum**). A long code calculated from a file's exact bytes. Change one byte and the hash changes completely. Package managers compare hashes to be sure nobody swapped a file. Zaryn stores every file by its hash.
- **Dependency.** A package your project uses. Your project lists its dependencies; the package manager fetches them.
- **Token.** A password for tools, not for people. Publishing needs a token with the `package:write` permission: on [Packages](/packages), press **Create a publish token**. Treat it like a password, and make a new one if it leaks.
- **Yank.** Hiding a broken version so new projects don't pick it up. Projects that already use it keep working.
- **Public / private.** Public packages anyone can install. Private ones only you (or your organization) can see; they are a Premium feature.
## What it costs
| | Free | Premium |
|---|---|---|
| Space for all your packages and images | 500 MB | 100 GB |
| Largest single file | 50 MB | 200 MB |
| Largest container image layer | 500 MB | 10 GB |
| Private packages | — | ✓ |
| Installing through the mirrors | ✓ | ✓ |
Installing other people's public packages, and using the mirrors, never counts against your space.
## Names
Names are first come, first served, separately for each kind: a Rust crate called `tool` and a Zig package called `tool` can belong to different people. Once you publish a name, only you (or the organization you published it for) can publish new versions of it.