- Home
- Container Registries
- Zot Registry
Zot Registry
What it is
Zot Registry is a free, Apache License 2.0 OCI-native container image registry for self-hosted and on-premises deployments, including setups alongside Kubernetes. It follows OCI Distribution Specification APIs and OCI Image Layout storage. Full and minimal builds are provided as single binaries, and Zot says root privileges are not required. The full image includes extensions for search, vulnerability scanning, synchronization, scrubbing, metrics, UI, management, and image trust, with search, UI, and management enabled by default. Storage can use local filesystems or AWS S3 and includes layer deduplication, garbage collection, background scrubbing, and multiple paths or backends. Authentication supports TLS, mTLS, htpasswd, LDAP, bearer tokens, and OpenID/OAuth2. Identity-based policies govern user or group actions on repositories and paths. Zot supports cosign and notation signatures, Helm charts, skopeo, cri-o, Prometheus metrics, logging, profiling, and benchmarking. Native Windows amd64 and arm64 binaries are distributed.
For and against
For
- Free Apache 2.0 open-source project
- Full and minimal single-binary builds
- Multiple storage backends
- Identity-based repository policies
- Vulnerability scanning and signatures
Against
- ORAS artifact support was removed in the listed release
- Designed for self-hosted deployment
The verdict
Zot Registry provides a broad OCI registry feature set in free, self-hosted builds. Its storage, authentication, policy, scanning, and monitoring options support controlled on-premises operations.
Who it suits
Zot suits teams operating container registries on their own infrastructure, including Kubernetes-adjacent environments. It also fits users needing configurable authentication, storage, scanning, and image-signing controls.
Plans and prices
Zot Registry
Apache 2.0 open-source project · Full or minimal builds
Read 11 Oct 2026 · zotregistry.dev
On the record
- Access control
- Zot supports identity-based access control with policies that allow or deny user actions on repositories.zotregistry.dev · read 11 Oct 2026
- Authentication
- Documented authentication options include local htpasswd, LDAP, mutual TLS, bearer tokens, and OpenID Connect.zotregistry.dev · read 11 Oct 2026
- Build options
- The project provides full and minimal builds, with the minimal build intended to reduce dependencies and attack surface.zotregistry.dev · read 11 Oct 2026
- Deployment
- Zot runs as a single binary and can be deployed on-premises, in cloud environments, on bare metal, or embedded in a product.zotregistry.dev · read 11 Oct 2026
- Deployment fit
- The feature summary describes zot as currently suitable for on-premises deployments, including deployments colocated with Kubernetes.zotregistry.dev · read 11 Oct 2026
- Image features
- The full container image includes extensions for search, CVE scanning, sync, scrub, metrics, UI, management, and image trust; search, UI, and management are enabled by default.zotregistry.dev · read 11 Oct 2026
- Image scanning
- Zot supports vulnerability scanning of stored container images.zotregistry.dev · read 11 Oct 2026
- Image security
- Zot supports vulnerability scanning of stored container images and image signatures using cosign and notation.zotregistry.dev · read 11 Oct 2026
- Integrations
- The feature summary names cosign and notation signatures, Helm charts, skopeo, cri-o, and Prometheus metrics support.zotregistry.dev · read 11 Oct 2026
- License
- Zot is released under the Apache License 2.0.zotregistry.dev · read 11 Oct 2026
- Limits
- The release notes state that support for ORAS artifacts was removed starting with the listed version, citing limited adoption and support.zotregistry.dev · read 11 Oct 2026
- Monitoring
- Zot supports logging, Prometheus metrics, benchmarking with zb, and performance profiling.zotregistry.dev · read 11 Oct 2026
- Project status
- The project homepage identifies zot as a CNCF Sandbox Project.zotregistry.dev · read 11 Oct 2026
- Purpose
- Zot is an OCI-native container image registry for storing, managing, and sharing container images and artifacts.zotregistry.dev · read 11 Oct 2026
- Security hardening
- The project describes PIE builds, minimal builds to reduce the attack surface, non-root deployment, code-owner reviews, and security scans of produced binaries.zotregistry.dev · read 11 Oct 2026
- Standards
- Zot uses OCI Distribution Specification APIs and OCI Image Layout for storage.zotregistry.dev · read 11 Oct 2026
- Storage
- Storage options include local filesystems and AWS S3, with deduplication, garbage collection, and background data scrubbing features.zotregistry.dev · read 11 Oct 2026
- Storage features
- Zot includes garbage collection, layer deduplication, data scrubbing, and support for multiple storage paths and backends.zotregistry.dev · read 11 Oct 2026
