Zot: The OCI-Native Container Registry That Replaces registry:2

Every team running containers eventually needs a private registry. The default answer is registry:2 — Docker's official registry image. It works. It's also showing its age: no UI, no vulnerability scanning, no garbage collection, no OCI artifact support.

Zot is the modern answer. It's an OCI-native container registry built purely on OCI standards — not Docker's proprietary format, just the OCI Distribution Specification and OCI Image Format, faithfully implemented. Single Go binary, no runtime dependencies, built-in authentication, and native support for everything the OCI ecosystem produces: container images, Helm charts, SBOMs, Cosign signatures, and arbitrary OCI artifacts.

What Zot is

Zot is a production-ready, vendor-neutral OCI image registry. Written in Go, Apache 2.0 licensed, CNCF Sandbox since December 2022. Latest stable: v2.1.18 (June 2026). 2,500+ GitHub stars at github.com/project-zot/zot.

The design philosophy: store images in OCI image format, serve via OCI Distribution Specification, add only what's needed to make it production-ready. No proprietary wire format, no vendor lock-in, no Docker daemon dependency.

Why OCI-native matters

The classic registry:2 was built around Docker's own image format, later extended for OCI. Zot was built for OCI from the start — no Docker legacy, no compatibility shims.

This matters because OCI registries now store far more than container images:

• Container images — Docker and OCI format
• Helm charts — pushed and pulled with helm push/pull
• Cosign signatures — image signing via Sigstore, stored as OCI referrers
• SBOMs — Software Bill of Materials attached as OCI artifacts
• ML models — versioned distribution via OCI
• Arbitrary files — via ORAS (OCI Registry As Storage)

Zot supports OCI referrers natively — the mechanism Cosign uses to attach signatures and SBOMs to images. An image and all its metadata live together and are queryable via the standard referrers API.

Core features

Single binary, no dependencies

Statically compiled Go binary, no external runtime dependencies. No Docker daemon, no Java, no separate database. Download, write a JSON config, run it. Works on Linux, macOS, ARM — including Raspberry Pi and edge hardware.

Built-in authentication and authorization

HTTP Basic Auth (htpasswd), LDAP, OAuth2/OIDC (Keycloak, Authentik, Dex), and Bearer tokens — all handled without a sidecar. Per-repository authorization policies defined in the config file.

Storage backends

Local filesystem by default (images stored in OCI layout format, directly inspectable). S3-compatible object storage (AWS S3, MinIO, Ceph) and GCS for production deployments.

Image replication

Sync images from upstream registries — Docker Hub, GHCR, other Zot instances — either on-demand (pull-through cache) or scheduled. Essential for air-gapped environments.

Vulnerability scanning

Trivy integration for CVE scanning. Results accessible via API and visible in the zui web interface.

Garbage collection and deduplication

Shared layers stored once across images. Automatic cleanup of unreferenced blobs and manifests. A CI/CD pipeline pushing images continuously won't fill your disk.

Docker Compose deployment

services:
  zot:
    image: ghcr.io/project-zot/zot-linux-amd64:latest
    container_name: zot
    restart: unless-stopped
    ports:
      - "5000:5000"
    volumes:
      - ./config.json:/etc/zot/config.json:ro
      - ./data:/var/lib/registry
    command: ["serve", "/etc/zot/config.json"]

Put Traefik in front for HTTPS and TLS termination. A minimal config.json:

{
  "distSpecVersion": "1.1.0",
  "storage": { "rootDirectory": "/var/lib/registry" },
  "http": { "address": "0.0.0.0", "port": "5000" },
  "log": { "level": "info" },
  "extensions": {
    "search": { "enable": true },
    "metrics": { "enable": true },
    "scrub": { "enable": true }
  }
}

Supply chain security — Cosign and SBOMs

Cosign stores image signatures as OCI referrers — attached to the image manifest via the referrers API. Zot supports this natively:

# Push, sign, and verify
docker push registry.example.com/myapp:latest
cosign sign --key cosign.key registry.example.com/myapp:latest
cosign verify --key cosign.pub registry.example.com/myapp:latest

# Attach SBOM
cosign attach sbom --sbom sbom.json registry.example.com/myapp:latest

# Query referrers
curl https://registry.example.com/v2/myapp/referrers/sha256:abc123...

The image, its signature, and its SBOM all live together in Zot, addressable through standard OCI APIs.

Zot vs alternatives

vs registry:2 — simpler to set up but lacks OCI artifact support, no built-in auth (needs Nginx proxy for htpasswd), no UI, no vulnerability scanning, no referrers API. Zot is the direct upgrade path.

vs Harbor — Harbor (CNCF Graduated) is more feature-complete: full UI, RBAC, project-based organization, audit logs. It's also eight containers vs one binary. Pick Harbor for enterprise governance; pick Zot for minimal operational overhead.

vs ECR / GAR / GHCR — managed cloud registries have zero operational overhead and cloud-native integrations. Zot is the right choice when data sovereignty, air-gap requirements, or cost at scale make managed registries unsuitable.

vs Nexus / Artifactory — universal artifact repositories that support Docker alongside Maven, npm, PyPI. Zot is purpose-built for OCI and far simpler for teams that only need container and OCI artifact storage.

Who it's for

Good fit:

• Teams running private registries who want more than registry:2 without Harbor's complexity
• Air-gapped environments that mirror public registries and serve images internally
• Organizations building supply chain security with Cosign and SBOMs
• Teams storing Helm charts, WASM modules, ML models as OCI artifacts
• Edge deployments needing a lightweight registry on modest hardware

Not the right fit:

• Teams needing Harbor's enterprise RBAC and project-based organization
• Organizations needing Maven, npm, PyPI alongside containers — Nexus/Artifactory instead
• Teams already happy with a managed cloud registry and no air-gap requirements

My take

Zot is the registry I'd run for any team that has outgrown registry:2 and doesn't need Harbor's full complexity. The single-binary deployment is genuinely low maintenance — no Postgres, no Redis, no eight-container compose stack. It handles the OCI ecosystem correctly, including referrers for Cosign signatures and SBOMs, which means it grows with supply chain security tooling rather than forcing workarounds.

The CNCF Sandbox backing and active development give it credibility. It won't replace Harbor for enterprise environments that need Harbor's governance features. But for the large middle ground — engineering teams running a private registry for CI/CD and internal image distribution — Zot's operational simplicity and OCI correctness make it a better default than what most teams currently run.