OCIregistry

Free plan APILinuxSelf-hosted

What OCIregistry is

OCIregistry is a free, pull-only OCI Distribution server for caching images as clients retrieve them. One instance can pull from multiple public, internal, or air-gapped upstream registries, including Docker Hub, Quay, registry.k8s.io, and GHCR. Upstream connections support anonymous or basic authentication, HTTP or HTTPS, one-way TLS, and mutual TLS. Cache state is stored as files in one filesystem subdirectory, allowing the image store and cache to be copied together. The project targets Kubernetes edge, air-gapped, development, and registry-offload deployments. It can run locally or as a Kubernetes workload through an Artifact Hub Helm chart. Docker, Podman, and Crane are documented clients. An administrative REST API lists images, blobs, and manifests, stops the server, and prunes cache entries by access time, creation time, or URL pattern, with dry runs. Images can be preloaded from URL lists or imported tarballs. Prometheus metrics and a health endpoint are optional settings. External token authentication currently supports Amazon ECR.

Who it suits

OCIregistry suits teams caching container images for Kubernetes edge, air-gapped, development, or registry-offload environments. It is designed for users comfortable running a local or self-hosted service.

What it does well

Pulls from multiple upstream registries
Supports mutual TLS and basic authentication
Cache can be copied as files
Administrative API includes pruning and listings
Preloads images from URLs or tarballs

What to know first

Only one server instance can serve clients
Maximum image path length is four segments
No documented security certifications or compliance attestations
Modified MIT License restricts AI training use

Verdict

OCIregistry focuses on pull-through image caching for Kubernetes-oriented deployments. Its broad upstream, transport, preload, and cache-management options are balanced by a single-instance serving limit and documented path constraint.

Facts from OCIregistry's own pages

Administrative API: The administrative REST API supports pruning the cache, listing images, blobs and manifests, and stopping the server. · aceeric.github.io, 11 Oct 2026
Authentication and transport: Upstream access supports anonymous and basic authentication, HTTP and HTTPS, one-way TLS, and mutual TLS. · aceeric.github.io, 11 Oct 2026
AWS integration: External token authentication currently supports Amazon ECR through the AWS SDK and requires the host to have an AWS account context. · aceeric.github.io, 11 Oct 2026
Cache pruning: Pruning can target images by access time, creation time, or URL pattern, and supports a dry-run option. · aceeric.github.io, 4 Oct 2026
Cache storage: The image cache is persisted as files beneath one filesystem subdirectory, which can be copied to another location and served there. · github.com, 11 Oct 2026
Deployment: The server can run as a single binary, a container, a Kubernetes workload using a Helm chart, or a systemd service. · github.com, 11 Oct 2026
External authentication: External token authentication is supported, and the documented token provider currently supports Amazon ECR. · aceeric.github.io, 4 Oct 2026
Image loading: Images can be preloaded from a text list of image URLs or imported from tarballs created by tools such as docker save or ctr images export. · aceeric.github.io, 11 Oct 2026
Kubernetes use: The project is intended as an edge OCI Distribution server for Kubernetes, including edge clusters, air-gapped clusters, and registry offload. · aceeric.github.io, 4 Oct 2026
License: The repository provides a modified MIT license that permits free use subject to its terms and disclaims warranties. · github.com, 11 Oct 2026
Notable limit: Only one server instance can serve clients because the image store is served from an in-memory cache synchronized with mutexes. · aceeric.github.io, 11 Oct 2026
Observability: Prometheus metrics and a health endpoint are optional configuration settings, and the Helm chart enables the health endpoint by default for cluster workloads. · aceeric.github.io, 11 Oct 2026
Path limit: The maximum supported image path has four segments when the upstream namespace is included in the path; containerd namespace query parameters allow an additional segment. · aceeric.github.io, 11 Oct 2026
Purpose: OCIregistry is a pull-only, pull-through caching OCI Distribution server that implements a subset of the OCI Distribution Specification. · aceeric.github.io, 11 Oct 2026
Registry client compatibility: The documentation demonstrates pulling through the server with Docker and also names Podman and Crane as supported client options. · aceeric.github.io, 4 Oct 2026
Security-related transport: The project documents secure and insecure HTTPS modes, one-way TLS, and mutual TLS for upstream access. · aceeric.github.io, 4 Oct 2026
Security scope: The project documentation describes upstream authentication and TLS options, but the pages reviewed do not state security certifications or compliance attestations. · aceeric.github.io, 11 Oct 2026
Single-instance limit: Because the server uses an in-memory cache synchronized with Go mutexes, the documentation says only one instance can serve clients and multiple Kubernetes replicas behind a service are unsupported. · aceeric.github.io, 4 Oct 2026
Target users: The project is designed mainly as a caching mirror for Kubernetes clusters, including edge, air-gapped, and development clusters. · aceeric.github.io, 11 Oct 2026
Upstream registries: One instance can pull from multiple internal, air-gapped, or public registries, including Docker Hub, Quay, registry.k8s.io, and GitHub Container Registry. · aceeric.github.io, 11 Oct 2026

Where OCIregistry stands on Freedom251

Container Registries#28 of 60