Your build cache shouldn't die with its vendor.

FosterStack is a self-hosted remote build cache server — a Develocity Build Cache Node replacement that speaks the same Gradle remote build cache HTTP protocol, so migrating is mostly a URL change. The same server implements the Apache Maven Build Cache Extension's remote HTTP mode (Maven acceptance coverage is in progress), so a mixed Gradle and Maven shop runs one deploy instead of two. Open source core, one-command deploy, and the thing that matters: it stays patched, on a promise.

Try it now

There is no signup, no waitlist, and no license key for the free tier. Pull the image and point your build at it:

docker run -d -p 8080:8080 ghcr.io/fosterstack/cache:latest
curl localhost:8080/healthz   # -> ok

Quickstart Migrate off Build Cache Node Read the source

Where it stands: v0.1 — early. The cache core and HTTP surface are tested, and the Gradle path is acceptance-tested against a real multi-module build in CI; the release pipeline works and its evidence chain is being rebuilt — the repository's SECURITY.md states exactly what is and is not proven today. Nobody is running it in a production build pipeline yet except us. Bugs and questions go to GitHub issues, which is also where the roadmap gets argued with.

Stay in touch

We do not collect email addresses. To follow the project, star the repository or use Watch → Custom → Releases on GitHub — that notifies you on a new release and nothing else, and it is a subscription you control and can revoke without asking us.

What you get that a bare HTTP endpoint doesn't give you

Yes — Gradle's remote cache protocol is just GET and PUT, and you could point it at any object store. What you'd be rebuilding yourself is everything around that:

Built to be verified, not trusted

We're a new vendor asking to sit in your build pipeline, so the burden of proof is on us. The answer is to make everything checkable:

• MIT-licensed core. Read the code before you run it.
• One public container image. Free and paid users pull the identical bytes — scan exactly what you deploy.
• When the paid tiers ship, a license key will unlock them in the same public image — no private registry, no gated downloads. (They are not built yet; the pricing below is direction, not a shelf.)
• Security patches are never withheld from the free tier. Not delayed, not embargoed — never.
• Signed commits, signed releases, public release notes. The repository's SECURITY.md states exactly what the release evidence does and does not prove today.

What we do not collect

• No telemetry, and no required FosterStack connection. The server reports nothing to us — no usage data, no license check, no update ping — and today's free core makes no outbound connections at all: it works identically on a machine with no route to the internet. When the paid features ship, the only outbound traffic will be what you configure (your identity provider for SSO, your peer replicas for HA) — endpoints you choose, never FosterStack.
• This website collects no email addresses. There is no signup form, no waitlist, and no newsletter. It sets no cookies, runs no analytics, and loads nothing from a third party.
• The only personal data FosterStack LLC holds is the irreducible minimum required to bill a paying customer — handled by Stripe — and whatever you voluntarily put in an email to support. See §2 of the terms of service.

Deliberately not claiming "we never collect any personal data": billing a customer requires an email address, and a privacy claim that is convenient but false is worse than none.

Pricing

Per product. Free is the full product.

No sales call. No per-seat tax. No enterprise pricing mystery.

The Compliance tier, plainly: the security evidence underneath — SBOMs, SLSA provenance, signatures, VEX statements, and the FIPS 140-3 validated module (CMVP certificate #5247) — is public and free, verifiable by anyone. What the tier sells is the authored analysis — a FIPS applicability statement mapping the validated module boundary onto this product — plus per-release attestation letters signed by FosterStack LLC, and time on your security questionnaires. FosterStack Cache is not "FedRAMP compliant" or "CMMC compliant"; those attach to your service and your organization, never to a component you deploy. It is validated crypto and publishable evidence for your compliance program.

Self-serve, credit card. Monthly tiers cancel anytime; Compliance is an annual term. Priced so an engineering manager can expense it without a procurement cycle.

Roadmap honesty

Gradle and Maven both run against the same server today; we maintain the cache server, while the Maven client side is Apache's own Build Cache Extension. A dependency cache — the same server restoring node_modules, ~/.m2, and ~/.gradle/caches by lockfile key, so ephemeral CI agents stop re-downloading the world — is next on the list, npm first. What is not on the list yet is a Helm chart and the paid tiers above — Team, Business, and Compliance are described so you know where this is going, not sold as available; Free is real and complete today. If you need something sooner, open an issue — that is what moves the roadmap.