- Home
- Container Registries
- OCIregistry
On the recordRead 11 Oct 202620 facts
OCIregistry
On the record
- Administrative API
- The administrative REST API supports pruning the cache, listing images, blobs and manifests, and stopping the server.aceeric.github.io · read 11 Oct 2026
- Authentication and transport
- Upstream access supports anonymous and basic authentication, HTTP and HTTPS, one-way TLS, and mutual TLS.aceeric.github.io · read 11 Oct 2026
- AWS integration
- External token authentication currently supports Amazon ECR through the AWS SDK and requires the host to have an AWS account context.aceeric.github.io · read 11 Oct 2026
- Cache pruning
- Pruning can target images by access time, creation time, or URL pattern, and supports a dry-run option.aceeric.github.io · read 4 Oct 2026
- Cache storage
- The image cache is persisted as files beneath one filesystem subdirectory, which can be copied to another location and served there.github.com · read 11 Oct 2026
- Deployment
- The server can run as a single binary, a container, a Kubernetes workload using a Helm chart, or a systemd service.github.com · read 11 Oct 2026
- External authentication
- External token authentication is supported, and the documented token provider currently supports Amazon ECR.aceeric.github.io · read 4 Oct 2026
- Image loading
- Images can be preloaded from a text list of image URLs or imported from tarballs created by tools such as docker save or ctr images export.aceeric.github.io · read 11 Oct 2026
- Kubernetes use
- The project is intended as an edge OCI Distribution server for Kubernetes, including edge clusters, air-gapped clusters, and registry offload.aceeric.github.io · read 4 Oct 2026
- License
- The repository provides a modified MIT license that permits free use subject to its terms and disclaims warranties.github.com · read 11 Oct 2026
- Notable limit
- Only one server instance can serve clients because the image store is served from an in-memory cache synchronized with mutexes.aceeric.github.io · read 11 Oct 2026
- Observability
- Prometheus metrics and a health endpoint are optional configuration settings, and the Helm chart enables the health endpoint by default for cluster workloads.aceeric.github.io · read 11 Oct 2026
- Path limit
- The maximum supported image path has four segments when the upstream namespace is included in the path; containerd namespace query parameters allow an additional segment.aceeric.github.io · read 11 Oct 2026
- Purpose
- OCIregistry is a pull-only, pull-through caching OCI Distribution server that implements a subset of the OCI Distribution Specification.aceeric.github.io · read 11 Oct 2026
- Registry client compatibility
- The documentation demonstrates pulling through the server with Docker and also names Podman and Crane as supported client options.aceeric.github.io · read 4 Oct 2026
- Security-related transport
- The project documents secure and insecure HTTPS modes, one-way TLS, and mutual TLS for upstream access.aceeric.github.io · read 4 Oct 2026
- Security scope
- The project documentation describes upstream authentication and TLS options, but the pages reviewed do not state security certifications or compliance attestations.aceeric.github.io · read 11 Oct 2026
- Single-instance limit
- Because the server uses an in-memory cache synchronized with Go mutexes, the documentation says only one instance can serve clients and multiple Kubernetes replicas behind a service are unsupported.aceeric.github.io · read 4 Oct 2026
Alternatives to OCIregistry
Inedo ProGetWebWindows+3JFrog Container RegistryWebWindows+3Volcengine Container RegistryAndroidiPhone & iPad+5Samsung Cloud Platform Container RegistryAndroidiPhone & iPad+3Chainguard RegistryWebLinux+18gears Container RegistryWebLinux+2Alibaba Cloud Container RegistryWebWindows+2KakaoCloud Container RegistryWebMac+2
