Angos

Paid APILinuxMacSelf-hostedWeb

What Angos is

Angos is a free, open-source OCI registry configured in one file and operated without a database or lock service. Its web interface lets users inspect repositories, manifests, referrers, pull history, and image filesystems layer by layer. Angos supports OCI 1.1 and works with Docker, Podman, containerd, and other OCI tools, including OCI referrers for signatures and SBOMs. It can mirror Docker Hub, ghcr.io, or another upstream registry through a pull-through cache, and replicate repositories to downstream registries in both directions with a durable retry queue. CEL policies and optional webhooks control repository push, pull, and delete access. Passwordless CI authentication uses OIDC, while Trivy or Grype can scan images on push and store reports beside images as referrers. Filesystem and S3-compatible storage are supported, with blobs and metadata configured independently. Retention rules and immutable tags manage image history. Angos supports TLS, mutual TLS, authentication, rate limiting, and fail-closed authorization. Standalone binaries are listed for Linux and macOS, and the license is Apache-2.0.

Who it suits

It suits teams needing a self-hosted or web-accessible registry for OCI images and artifacts. Developers and operators can use its caching, replication, policy, scanning, retention, and OIDC features.

What it does well

Runs without a database
Supports OCI 1.1 tooling
Image scanning with Trivy or Grype
S3 and filesystem storage
Immutable tags and retention rules

What to know first

Filesystem storage is single-instance unless shared
Multiple instances recommend shared S3 storage
Deployment and security configuration remain required
No hosted pricing plan is listed

Limits

Filesystem storage supports one instance unless shared storage is used; the storage documentation recommends shared S3 for multiple registry instances. The listed standalone downloads target Linux and macOS architectures.

Getting started

Open the Angos website
Choose a Linux or macOS standalone binary, or follow the Docker Compose or Kubernetes deployment guide
Create the one-file registry configuration
Select filesystem or S3-compatible storage for blobs and metadata
Connect Docker, Podman, containerd, or another OCI tool
Configure access policies, CI OIDC, caching, replication, or scanning as needed

Verdict

Angos provides a database-free OCI registry with inspection, replication, policy, scanning, and retention controls. Its free Apache-2.0 model suits teams prepared to manage deployment, storage, and security themselves.

Questions

Is Angos free?

Yes. Angos is listed as free and open source under the Apache-2.0 license.

Which tools work with Angos?

Angos supports OCI 1.1 and works with Docker, Podman, containerd, and other OCI tools.

Can Angos scan images?

Yes. Trivy or Grype can scan images on push, with reports stored as OCI referrers.

What storage does Angos support?

It supports filesystem and S3-compatible object storage, with blobs and metadata configurable independently.

How does CI authenticate?

Passwordless authentication supports OIDC from GitHub Actions, Kubernetes, or another issuer.

Does Angos support immutable tags and retention?

Yes. Retention rules can keep tags by age, semantic-version pattern, or recent pushes and pulls, and immutable tags can protect releases.

Facts from Angos's own pages

Access control: CEL policies and optional webhooks control push, pull, and delete access per repository. · angos.dev, 11 Oct 2026
Artifact verification: The release page says artifacts are signed with keyless Sigstore Cosign using GitHub Actions OIDC, with verification backed by the public Sigstore transparency log. · github.com, 11 Oct 2026
Caching: It can mirror Docker Hub, ghcr.io, or another upstream registry through a pull-through cache. · angos.dev, 11 Oct 2026
CI authentication: Passwordless CI authentication supports OIDC from GitHub Actions, Kubernetes, or another issuer. · angos.dev, 11 Oct 2026
Downloads: The v1.12.2 release lists standalone binaries for Linux amd64 and arm64, and macOS Intel and Apple silicon. · github.com, 11 Oct 2026
Image inspection: Its web UI browses repositories, manifests, referrers, pull history, and image filesystems layer by layer. · angos.dev, 11 Oct 2026
Integrations: The project README lists Docker Compose and Kubernetes deployment guides, GitHub Actions OIDC setup, and Trivy or Grype scanning. · github.com, 11 Oct 2026
License: The project’s GitHub repository identifies its license as Apache-2.0. · github.com, 11 Oct 2026
Maker details: The site footer credits “Angos Maintainers”; the pages opened did not state a headquarters or founding year. · angos.dev, 11 Oct 2026
OCI compatibility: Angos supports Docker, Podman, containerd, and other OCI tools, including OCI referrers for signatures and SBOMs. · angos.dev, 11 Oct 2026
Operations: Angos requires no database or lock service, supports replicas sharing storage, and runs garbage collection, scrub, and prune while serving. · angos.dev, 11 Oct 2026
Product: Angos is an OCI registry configured in one file and run without a database. · angos.dev, 11 Oct 2026
Registry compatibility: Angos supports OCI 1.1 and works with Docker, Podman, containerd, and other OCI tools. · angos.dev, 11 Oct 2026
Release verification: The v1.12.2 release says artifacts are signed with keyless Sigstore Cosign using GitHub Actions OIDC. · github.com, 11 Oct 2026
Replication: It mirrors repositories to downstream registries in both directions with a durable retry queue. · angos.dev, 11 Oct 2026
Retention: Retention rules can keep tags by age, semantic-version pattern, or recent pushes and pulls; immutable tags can protect releases from overwrites. · angos.dev, 11 Oct 2026
Scaling: For multiple registry instances, the storage documentation recommends shared S3 storage; filesystem storage is single-instance unless shared storage is used. · angos.dev, 11 Oct 2026
Scanning: Trivy or Grype can scan images on push, with reports stored beside the image as OCI referrers. · angos.dev, 11 Oct 2026
Security: The security model documents TLS, authentication, rate limiting, and fail-closed authorization behavior for critical security decisions. · angos.dev, 11 Oct 2026
Security features: Angos supports mutual TLS and can run Trivy or Grype vulnerability scans on push, keeping reports beside images as OCI referrers. · angos.dev, 11 Oct 2026
Storage: The project README says Angos stores its data in the image storage, which can be a directory or an S3 bucket. · github.com, 11 Oct 2026
Supported downloads: The release page lists standalone binaries for macOS amd64 and arm64 and Linux amd64 and arm64. · github.com, 11 Oct 2026

Where Angos stands on Freedom251

Container Registries#39 of 60