🩺 Vitals
- 🟢 Last active: 2026-08-28
- 📦 Latest release: v3.1.1 (2026-05-01)
- 🐞 Open issues: 511
- 🌟 Stars: 10.6k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: distribution.github.io
- Source: github.com/distribution/distribution
- License: Apache 2.0
- Deployment: Docker | Kubernetes
- Data Model: OCI blobs on pluggable storage (filesystem, S3, GCS or Azure)
- Jurisdiction: USA 🇺🇸 (CNCF / Linux Foundation)
- Compliance (SaaS): N/A
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: Low (2/5) - Single container, but production needs external auth and a reverse proxy
- Maintenance: Low (2/5) - Few moving parts; you own the TLS and auth you wrap around it
- Enterprise Ready: Low (2/5) - No built-in RBAC, UI, scanning or signing; a storage engine you extend
1. The Executive Summary
What is it? Distribution, formerly the Docker Registry, is the reference implementation of the OCI Distribution Specification: a minimal, self-hosted server for storing and serving container images and OCI artifacts. It is deliberately small, handling the storage and transfer of images while leaving authentication, access control and a web interface to the layers you place around it. Though it sits at the CNCF Sandbox tier, the code long predates that donation and is the registry engine many larger platforms, including Harbor, are built upon.
The Strategic Verdict:
- 🟢 For a minimal self-hosted registry or an embedding base: Strong Buy. A small, foundation-governed OCI registry with pluggable storage, ideal when you want to store images on your own infrastructure without operating a full platform.
- 🔴 For teams needing RBAC, scanning or a UI out of the box: Look higher up the stack. Distribution ships none of these; you either build them around it or run Harbor, which does exactly that.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | Docker Hub (SaaS) | Distribution (Self-Hosted) |
|---|---|---|
| Storage & Pulls | Metered and rate-limited | Your storage, no limits |
| Data Custody | Third-party cloud | Your infrastructure |
| Licensing | Paid tiers for teams | None (Apache 2.0) |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: A single Docker container or a Kubernetes deployment, configured by a small YAML file. It is running in minutes; making it production-safe is the longer task.
- Hardening is your responsibility: Bare Distribution exposes the registry with only basic building blocks for TLS and token authentication. A production deployment puts it behind a reverse proxy for TLS and an external identity or token provider for access control.
- Storage is pluggable: Image blobs live on the local filesystem or an S3, GCS or Azure-compatible backend of your choosing. This is where the data-portability and sovereignty story sits, since the artifacts are standard OCI objects on storage you control.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & Foundation Governance: Distribution is a CNCF project under the Linux Foundation, a US-based non-profit, with a multi-vendor contributor base and a permissive Apache 2.0 licence. Governance is neutral and no single vendor controls it, and the software stores only the artifacts you place in it.
- The Compliance Shift: Distribution provides primitives (token authentication endpoints, TLS) but not the RBAC, audit logging or vulnerability scanning that an audited supply chain expects. You supply those around it or adopt Harbor, which wraps Distribution with exactly that layer. No certification attaches to the software itself.
- Minimal by Design, Not Enterprise by Default: Apache 2.0 carries no copyleft or paywall, so there is no commercial trap. The honest caveat is scope: this is a storage engine, not a governance platform, and its security posture is only as strong as what you build around it.
4. Market Landscape
🏢 Proprietary Incumbents
- Docker Hub: The ubiquitous managed registry. Convenient, but it meters pulls and storage, rate-limits free usage, and keeps your images on a third-party service rather than your infrastructure.
- AWS Elastic Container Registry: The managed cloud registry inside AWS. Operationally simple there, but metered per gigabyte and per transfer, and it binds your image store to a single US hyperscaler.
🤝 Open Source Ecosystem
- Harbor: The layer above. Harbor wraps a registry with RBAC, vulnerability scanning, signing, replication and a web UI, turning the bare storage engine into an auditable control point.
- Zot: A modern, OCI-native minimal registry in the same lightweight role as Distribution, built OCI-first rather than carried forward from the Docker Registry lineage.