Skip to content
SPECIFICTION
Get listed

Zot Registry

zotregistry.dev

Free plan WebmacOSLinuxAPISelf-hosted
Visit zotregistry.dev
Spec score 7.9 #14 of 60 in Container Registries

What it is

Zot Registry is an OCI-native container image registry that follows OCI Distribution Specification APIs and uses OCI Image Layout for storage. The project provides full and minimal single-binary builds and says Zot does not need root privileges. The full container image includes extensions for search, vulnerability scanning, synchronization, scrubbing, metrics, a user interface, management, and image trust; search, UI, and management are enabled by default. Storage can use local filesystems or AWS S3, with layer deduplication, garbage collection, background scrubbing, and multiple storage paths and backends. Authentication options include TLS and mTLS, htpasswd, LDAP, bearer tokens, and OpenID/OAuth2. Identity-based policies can control repository or path actions by user or group. Zot also supports cosign and notation signatures, Helm charts, skopeo, cri-o, Prometheus metrics, logging, profiling, and benchmarking with zb. The project describes it as suitable for on-premises deployments, including alongside Kubernetes. Zot is free under Apache License 2.0 and identified by its project homepage as a CNCF Sandbox Project. Native Windows binaries for amd64 and arm64 are distributed. Release notes state that ORAS artifact support was removed starting with the listed version.

Spec sheet

Purpose
Zot is an OCI-native container image registry for storing, managing, and sharing container images and artifacts.Read 11 Oct 2026 · zotregistry.dev
Platforms
The release page lists Linux, macOS, and FreeBSD binaries for Intel and ARM architectures; building container images for FreeBSD is unsupported.Read 11 Oct 2026 · zotregistry.dev
Deployment
Zot runs as a single binary and can be deployed on-premises, in cloud environments, on bare metal, or embedded in a product.Read 11 Oct 2026 · zotregistry.dev
Integrations
The feature summary names cosign and notation signatures, Helm charts, skopeo, cri-o, and Prometheus metrics support.Read 11 Oct 2026 · zotregistry.dev
License
Zot is released under the Apache License 2.0.Read 11 Oct 2026 · zotregistry.dev
Access control
Zot supports identity-based access control with policies that allow or deny user actions on repositories.Read 11 Oct 2026 · zotregistry.dev
Authentication
Documented authentication options include local htpasswd, LDAP, mutual TLS, bearer tokens, and OpenID Connect.Read 11 Oct 2026 · zotregistry.dev
Build options
The project provides full and minimal builds, with the minimal build intended to reduce dependencies and attack surface.Read 11 Oct 2026 · zotregistry.dev
Deployment fit
The feature summary describes zot as currently suitable for on-premises deployments, including deployments colocated with Kubernetes.Read 11 Oct 2026 · zotregistry.dev
Image features
The full container image includes extensions for search, CVE scanning, sync, scrub, metrics, UI, management, and image trust; search, UI, and management are enabled by default.Read 11 Oct 2026 · zotregistry.dev
Image scanning
Zot supports vulnerability scanning of stored container images.Read 11 Oct 2026 · zotregistry.dev
Image security
Zot supports vulnerability scanning of stored container images and image signatures using cosign and notation.Read 11 Oct 2026 · zotregistry.dev
Limits
The release notes state that support for ORAS artifacts was removed starting with the listed version, citing limited adoption and support.Read 11 Oct 2026 · zotregistry.dev
Monitoring
Zot supports logging, Prometheus metrics, benchmarking with zb, and performance profiling.Read 11 Oct 2026 · zotregistry.dev
Project status
The project homepage identifies zot as a CNCF Sandbox Project.Read 11 Oct 2026 · zotregistry.dev
Security hardening
The project describes PIE builds, minimal builds to reduce the attack surface, non-root deployment, code-owner reviews, and security scans of produced binaries.Read 11 Oct 2026 · zotregistry.dev
Standards
Zot uses OCI Distribution Specification APIs and OCI Image Layout for storage.Read 11 Oct 2026 · zotregistry.dev
Storage
Storage options include local filesystems and AWS S3, with deduplication, garbage collection, and background data scrubbing features.Read 11 Oct 2026 · zotregistry.dev
Storage features
Zot includes garbage collection, layer deduplication, data scrubbing, and support for multiple storage paths and backends.Read 11 Oct 2026 · zotregistry.dev
Windows support
The release notes state that native Windows binaries for amd64 and arm64 are distributed.Read 11 Oct 2026 · zotregistry.dev

Plans and prices

Zot Registry Free Apache 2.0 open-source project · Full or minimal builds Read 11 Oct 2026 · zotregistry.dev

Every Zot Registry plan and price →

Strong points and limits

Strong points

  • Full and minimal single-binary builds
  • Does not require root privileges
  • Supports local filesystem and AWS S3 storage
  • Includes vulnerability scanning and image signatures
  • Free under Apache License 2.0

Limits

  • ORAS artifact support was removed in the listed version
  • Project describes suitability for on-premises deployments
  • Search, UI, and management are enabled by default in the full image

Who it suits

Zot suits teams seeking an OCI registry for on-premises environments, including deployments colocated with Kubernetes. Its storage, authentication, and identity-policy options are relevant to teams managing container images across repositories or paths.

Verdict

Zot pairs OCI registry support with storage, scanning, signing, and access-control features in a free open-source project. Note the stated removal of ORAS artifact support when checking compatibility.

Where Specifiction places it

Alternatives to Zot RegistryAll alternatives →