ZenoRegistry

Paid APISelf-hostedWeb

What ZenoRegistry is

ZenoRegistry is a self-hosted, OCI-compliant container registry for internal enterprise use. Its server, OCI API, administration REST API, and embedded dashboard are delivered in one Go binary, with PostgreSQL and S3-compatible object storage required at runtime. It handles OCI image and artifact operations including push, pull, tag and catalog listing, chunked uploads, cross-repository blob mounts, and manifest deletion. Docker, Podman, and nerdctl are named compatible clients. Storage drivers work with AWS S3, MinIO, Ceph, DigitalOcean Spaces, Scaleway Object Storage, and other S3-compatible services. OIDC single sign-on supports providers such as Keycloak, Entra ID, Google Workspace, Authentik, Okta, and Dex. Pull, push, and admin roles use repository-and-action JWT scopes. Retention rules, supply-chain metadata recognition, native TLS, migrations, health checks, JSON logs, and Kubernetes guidance are included.

Who it suits

It suits internal platform teams, sovereign or air-gapped deployments, GitOps users, and organizations seeking a self-hosted alternative to SaaS registries. The maker also positions it for Cosign supply-chain workflows.

What it does well

OCI push, pull, and artifact operations
OIDC single sign-on integrations
Repository-level pull, push, and admin roles
Retention rules with dry-run previews
S3-compatible storage integrations

What to know first

PostgreSQL is required at runtime
S3-compatible object storage is required
Pricing is available only on request

Plans

Plan	Billed and limits	Price
Self-hosted licence	Contact for licence; no per-seat fees stated	On request

As citiumsoftware.com lists them, read 4 Oct 2026. The maker's own page has the final word.

Verdict

ZenoRegistry combines OCI registry functions, enterprise identity controls, retention policies, and supply-chain metadata handling in a self-hosted package. Its runtime dependencies and contact-based pricing are important considerations for deployment planning.

Facts from ZenoRegistry's own pages

Access control: It provides pull, push, and admin roles, with JWT scopes checked per repository and action on OCI requests. · citiumsoftware.com, 4 Oct 2026
Company location: Citium Software describes its European roots as being in Denmark, and its contact page lists Denmark, European Union. · citiumsoftware.com, 4 Oct 2026
Deployment: The server, OCI API, admin REST API, and embedded admin UI ship in one Go binary; PostgreSQL and S3-compatible object storage are its runtime dependencies. · citiumsoftware.com, 4 Oct 2026
Headquarters: Denmark, European Union · citiumsoftware.com, 28 Sept 2026
Identity integrations: Admin dashboard SSO supports OIDC providers including Keycloak, Entra ID, Google Workspace, Authentik, Okta, and Dex; local admin is available as an emergency option. · citiumsoftware.com, 4 Oct 2026
Image retention: Retention policies can keep a specified number of recent tags or tags within a specified age, protect glob patterns, and enforce a per-repository safety floor; dry-run previews are available. · citiumsoftware.com, 4 Oct 2026
Integrations: The page says Argo CD and Flux can pull from ZenoRegistry and that it ships as a core service in the ZenoKube sovereign cloud platform. · citiumsoftware.com, 4 Oct 2026
Intended users: The maker describes it for internal platform teams, sovereign or air-gapped deployments, GitOps, Cosign supply-chain workflows, and organizations seeking a self-hosted alternative to SaaS registries. · citiumsoftware.com, 4 Oct 2026
OCI support: It implements OCI push, pull, tag listing, catalog, chunked uploads, cross-repository blob mounts, and manifest deletion, and the page names Docker, Podman, and nerdctl as compatible clients. · citiumsoftware.com, 4 Oct 2026
Operations: It includes a dependency-free health endpoint, graceful shutdown, structured JSON logs, automatic PostgreSQL migrations, and Kubernetes deployment guidance. · citiumsoftware.com, 4 Oct 2026
Purpose: ZenoRegistry is a self-hosted, OCI-compliant container registry for internal enterprise use. · citiumsoftware.com, 4 Oct 2026
Security controls: The page describes bearer JWTs, HTTP-only SameSite=Lax admin session cookies, bcrypt password hashing, configurable token lifetime, native TLS, and OIDC login. · citiumsoftware.com, 4 Oct 2026
Storage integrations: Its S3-compatible storage driver works with AWS S3, MinIO, Ceph, DigitalOcean Spaces, Scaleway Object Storage, and other S3-compatible services. · citiumsoftware.com, 4 Oct 2026
Supply chain: The registry recognizes Cosign signatures, attestations, SBOM sibling tags, and multi-architecture references, and excludes signatures and SBOMs from retention deletion. · citiumsoftware.com, 4 Oct 2026
Support: The maker invites customers to contact it for a demo, managed deployment, or self-hosted licence; its contact page says inquiries receive a response within 24 hours on business days. · citiumsoftware.com, 4 Oct 2026

Where ZenoRegistry stands on Freedom251

Container Registries#53 of 60