zot is an OCI-native container image and artifact registry that stays deliberately close to the standards: images are stored in OCI image format, the OCI Distribution Specification is spoken on the wire, and no proprietary metadata layer sits in between. It ships as a single statically linked Go binary that needs no database, no cache and no sidecar services, and it can run as an unprivileged process on a host or as a container on Kubernetes.

What it does

A zot registry is a read-write endpoint that any OCI client can push to and pull from – Docker, Podman, containerd, Helm, cosign, ORAS and friends. It implements the Distribution Spec rather than a Docker-specific approximation, so OCI artifacts such as Helm charts, SBOMs and signatures live next to the images they describe. The project is a CNCF Sandbox project released under the Apache License 2.0, with Full and Minimal builds: the Full build bundles the optional features, the Minimal build strips them for a smaller attack surface.

Notable capabilities

• Built-in web UI for browsing repositories, tags, platforms and image details without a separate front end.
• Search over a GraphQL API, which the UI itself uses – useful for dashboards and scripts that need to query repository metadata.
• Authentication and authorisation with htpasswd, LDAP and OpenID Connect, plus per-repository read/write policies.
• Signature and provenance checks for cosign and notation signatures, and immutable tags for the releases you never want overwritten.
• Vulnerability scanning (Trivy-based) and SBOM generation as extensions to the same binary.
• Retention policies and garbage collection, with blob deduplication, so old tags can expire and space is actually reclaimed.
• Mirroring and sync for pull-through caching of upstream registries, and OCI registry mirroring for containerd.
• Scale-out clustering and a documented highly-available deployment when one node is not enough.
• Prometheus metrics and structured logs for monitoring.
• Pluggable storage – local filesystem, S3-compatible object storage, and the usual cloud object stores.

Running it

The fastest start is the published container image with a three-line config file: a storage root directory, an HTTP listen address, and optionally the extensions you want. In testing, a fresh instance came up on HTTP port 5000 and was immediately usable – images pushed with an OCI client appeared in the web UI within seconds. Enable the ui and search extensions in the config if you want the browser interface; a bare config serves the registry API only. Production deployments usually add TLS termination in front of it, an auth provider, and object storage instead of a local volume.

Because there is nothing to compile, nothing to migrate and only one binary to upgrade, zot suits small teams that want a standards-compliant private registry they can actually operate, and cluster admins who want a caching mirror in front of Docker Hub. Compare it with the rest of the directory on the All Tools page.