Yes. A Bazel registry is a local directory or a static HTTP server in a defined layout, so you can host your own, and its settings file can list mirrors for source archives. That gives you a controlled place to approve modules instead of fetching straight from the public internet.
What a registry is
Bazel discovers dependencies by requesting information from registries, which are databases of modules. The documentation says Bazel supports one type: index registries. An index registry lists modules with their homepage, maintainers, the MODULE.bazel of each version, and how to fetch each version's source. It does not need to serve the source archives itself.
The layout
- A registry settings file, optional, with registry wide metadata.
- A modules directory with one subdirectory per module.
- Per module, a metadata file listing versions and yanked versions.
- Per version, the MODULE.bazel used in resolution, a source file describing how to fetch the source, and optional patches and overlay directories.
One detail matters for review: the MODULE.bazel in the registry is the one read during resolution, not the one inside the source archive, unless a non-registry override is used. Whoever controls the registry controls the dependency metadata Bazel believes.
Mirrors
The registry settings file can contain a mirrors list. Bazel tries mirror URLs first, built by joining the mirror with the source URL minus its protocol, and falls back to the original source URL last. For example, a source at foo.com/bar/baz with a mirror at mirror1.com would be tried at mirror1.com/foo.com/bar/baz before the original.
Notice the fallback. If your goal is a closed environment, a mirror list alone does not stop Bazel from going to the origin. Pair it with network egress rules or with vendor mode.
Choosing an approach
| Approach | Good for | Watch out for |
|---|---|---|
| Public registry only | Speed of setup | No approval step |
| Private index registry in front | Curated, approved set | You maintain the metadata and yank decisions |
| Mirrors for source archives | Availability, caching | Fallback to origin still happens |
| Vendor mode | Offline and audited builds | Repository size, re-vendoring |
You can also force one module to come from a particular registry using a single version override with a registry attribute.
Operating a private registry
- Require a pull request and a second reviewer for any change to the registry repository.
- Record checksums for every source archive.
- Use the yanked versions field to withdraw versions you no longer permit, with a reason and a link.
- Serve over HTTPS with access control for the write path.
- Decide who is accountable for approving new modules.
Quick check
Does a mirror list force Bazel to avoid the original URL?
No. Bazel tries mirrors first and finally the original source URL, so add network controls if you need to block it.
Does the registry need to host source archives?
No. It can point at archives elsewhere, which is why checksums in the source file matter.
Sources
Last reviewed: 19 October 2026.
