🩺 Vitals
- 🟢 Last active: 2026-08-31
- 📦 Latest release: v2.1.20 (2026-08-04)
- 🐞 Open issues: 88
- 🌟 Stars: 2.7k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: zotregistry.dev
- Source: github.com/project-zot/zot
- License: Apache 2.0
- Deployment: Docker | Native
- Data Model: OCI-native storage (filesystem or S3-compatible); no external database
- Jurisdiction: USA 🇺🇸 (CNCF / Linux Foundation)
- Compliance (SaaS): N/A
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: Low (1/5) - Single static binary with no external dependencies
- Maintenance: Low (1/5) - One binary to update; no database or object store to operate
- Enterprise Ready: Medium (3/5) - RBAC, scanning and replication included, but a younger Sandbox project with a smaller footprint than Harbor
1. The Executive Summary
What is it? Zot is an OCI-native container registry delivered as a single, statically compiled binary. Unlike the reference Distribution registry, it ships with built-in authentication, RBAC, vulnerability scanning and registry-to-registry replication; unlike Harbor or Quay, it provides those without an external database or object store to run. It keeps images in the standard OCI layout directly on the filesystem or S3-compatible storage, which makes both the deployment and the data trivially portable.
The Strategic Verdict:
- 🟢 For a lightweight but secure self-hosted registry: Strong Buy. One binary gives you RBAC, vulnerability scanning and replication with no PostgreSQL, Redis or object store to operate, filling the gap between the bare Distribution engine and a full Harbor deployment.
- 🔴 For large multi-tenant estates needing a mature UI and ecosystem: Weigh Harbor. Zot is a younger CNCF Sandbox project with a smaller footprint; Harbor brings a graduated project's adoption, richer web UI and broader tooling.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | Docker Hub (SaaS) | Zot (Self-Hosted) |
|---|---|---|
| Storage & Pulls | Metered and rate-limited | Your storage, no limits |
| Data Custody | Third-party cloud | Your infrastructure |
| Licensing | Paid tiers for private or team use | None (Apache 2.0) |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: A single Native binary or a lightweight Docker image, configured by one file. There is no separate database, cache or object-store service to stand up alongside it.
- Security ships in the binary: Authentication, fine-grained RBAC, Trivy-based vulnerability scanning and registry-to-registry sync are part of the core rather than add-ons, which is what sets it apart from the bare reference registry.
- Storage is OCI-native: Images are written in the standard OCI layout on the local filesystem or an S3-compatible backend, so data exit is a direct copy rather than an export step.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & Foundation Governance: Zot is a CNCF project under the Linux Foundation, a US-based non-profit, with vendor-neutral governance and multiple contributing entities. No single vendor controls it, and the software stores only the artifacts you place in it.
- The Compliance Shift: Zot provides the controls a compliant registry needs (RBAC, vulnerability scanning, hardened builds), but no certification attaches to the self-hosted software. Infrastructure security, access policy and certifying the deployment remain your responsibility.
- No Licence Trap, but a Young Project: Apache 2.0 carries no copyleft or paywall, so there is no commercial trap and every feature is free. The honest caveat is maturity: this is a CNCF Sandbox project with a smaller community and adoption base than the graduated Harbor, so it carries more roadmap and ecosystem risk in exchange for a far lighter operational footprint.
4. Market Landscape
🏢 Proprietary Incumbents
- Docker Hub: The ubiquitous managed registry. Convenient, but it meters pulls and storage, rate-limits free usage, and keeps your images on a third-party service rather than your infrastructure.
- AWS Elastic Container Registry: The managed cloud registry inside AWS. Operationally simple there, but metered per gigabyte and per transfer, and it binds your image store to a single US hyperscaler.
🤝 Open Source Ecosystem
- Distribution: The barer alternative. The reference OCI registry Zot shares a lineage of standards with, but without Zot's built-in authentication, scanning and replication.
- Harbor: The heavyweight alternative. A graduated platform with a full web UI, multi-tenancy and a larger ecosystem, at the cost of running PostgreSQL, Redis and object storage.