Trow

Free plan APILinuxSelf-hosted

What Trow is

Trow is a free, open-source container registry and image cache designed to run inside Kubernetes clusters. It gives organizations a self-hosted registry for their images and can cache external images locally while proxying registries. An admission webhook uses approve and deny lists to control which images may run. Trow follows the OCI Distribution Specification, including methods for listing repositories and tags, and supports OCI artifacts. Proxy credentials can be set for each registry host and repository path prefix. A Helm chart is available for deployment, while cluster-wide caching requires suitable containerd or cri-o configuration. The project is distributed under Apache-2.0. Its README labels the software beta and warns of rough edges. Vulnerability scanning, existing authentication integrations, distributed high availability, scalability, and complete access auditing are listed as planned. Image data is stored in files, with no S3 option listed.

Who it suits

Trow suits Kubernetes operators wanting a lightweight registry, local image caching, or admission controls against unauthorized images. It is also relevant to teams comfortable with beta, self-hosted software.

What it does well

Free and open-source under Apache-2.0
Runs inside Kubernetes clusters
Caches external images locally
Admission approve and deny lists
Supports OCI artifacts

What to know first

Project is marked beta
Vulnerability scanner integration is planned
No S3 storage option listed
High availability architecture is planned

Verdict

Trow combines a Kubernetes-native registry with local caching and image admission controls. Its beta status and several planned integrations mean teams should assess whether current capabilities meet their operational needs.

Facts from Trow's own pages

Availability: The project README describes Trow as beta and says users can expect rough edges. · github.com, 11 Oct 2026
Credentials: Proxy credentials can be configured per registry host and repository path prefix. · github.com, 11 Oct 2026
Deployment: Trow runs inside a Kubernetes cluster, and the project provides a Helm chart. · github.com, 11 Oct 2026
Image caching: Trow can cache external images locally in a cluster and proxy registries. · github.com, 11 Oct 2026
Image controls: An admission webhook can control which images run in the cluster using approve and deny lists. · github.com, 11 Oct 2026
Installation: A Helm chart is available for installing Trow. · github.com, 11 Oct 2026
Integrations: The user guide describes configuring Trow with containerd and shows Podman and curl examples for pulling images. · github.com, 11 Oct 2026
License: The project repository identifies its license as Apache-2.0. · github.com, 11 Oct 2026
Planned capabilities: A distributed architecture for high availability and scalability, and full auditing and authentication of image access, are listed as coming soon or planned. · github.com, 11 Oct 2026
Planned integrations: The official site lists vulnerability scanner integration and integration with existing authentication and authorization solutions as planned features. · trow.io, 11 Oct 2026
Product: Trow is a container registry and image cache designed to run inside Kubernetes clusters. · trow.io, 11 Oct 2026
Registry API: Trow implements the OCI Distribution Specification, including API methods for listing repositories and tags. · github.com, 11 Oct 2026
Registry standard: Trow conforms to the OCI Distribution Specification for registries. · github.com, 11 Oct 2026
Security: Integration with vulnerability scanners and existing authentication and authorization solutions is listed as planned on the product site. · trow.io, 11 Oct 2026
Self-hosted registry: Trow provides a self-hosted registry for an organization’s images. · trow.io, 11 Oct 2026
Storage limit: Trow stores image data in files and the architecture guide says it has no option for storage such as S3. · github.com, 11 Oct 2026
Target users: The README describes use cases for running a lightweight registry in Kubernetes and preventing unauthorized images from reaching the cluster. · github.com, 11 Oct 2026

Where Trow stands on Freedom251

Container Registries#33 of 60