Chainguard Registry vs Django-OCI

Chainguard Registry provides Chainguard Containers: minimal container images rebuilt from source daily. Its directory lists 3,115 projects and 735,898 images. Chainguard says images are continuously built in SLSA L3 hardened infrastructure with CVE patching, and lists Sigstore-signed artifacts with build-time SBOMs and digital attestations. The free offer allows up to five images per organization; the FAQ describes a freely available set of about 50 images, limited to:latest tags and without a CVE remediation SLA. Catalog plans include upstream-supported major and minor tags, contractual remediation timelines of seven days for critical vulnerabilities and 14 days for other listed severity levels, and requests for new images. Catalog features also include automated Custom Assembly tooling, a private APK repository with more than 10,000 packages, and STIG-hardened and FIPS-validated images. Images can be pulled from Chainguard or mirrored to listed artifact managers. Chainguard lists compatibility with multiple scanners. Free Images costs nothing; Catalog is priced on request. The product runs on Linux, self-hosted, and web environments.

Django-OCI is free, open-source software for Python developers building registries that follow the OpenContainers Distribution Specification. The Django module exposes API endpoints for pushing, pulling, and interacting with container images, and can run in a virtual environment or within a container-orchestrated registry. Installation is available through pip or a GitHub checkout and includes Django Rest Framework. Filesystem storage is the default option, intended for smaller registries without external cloud storage. Authentication uses a Docker-style OAuth 2.0 flow with username and account-token credentials plus JWT access tokens. Configuration covers URL prefixes, specification version, content types, storage, authentication, token and session expiry, request limits, and manifest-tag deletion. There is no frontend for viewing containers. Private repositories and repository ownership or contributors are not implemented. The project is described as early development, with most goals still under development. Python tests and distribution-spec conformance testing are documented. Developers are asked to consider GDPR compliance, open an issue for help, and review the project license before use.