Zot Registry

Overview

Zot Registry is an open-source container image registry built around OCI standards. It is best suited to teams operating their own infrastructure who want control over image storage and repository access. Its broad security and operations toolkit makes it a strong on-premises option, but the removal of ORAS artifact support can make it unsuitable for some artifact workflows.

Key features

Zot is available in full and minimal single-binary builds, and it can run without root privileges. The minimal build is intended to reduce dependencies and attack surface; the full container image adds search, vulnerability scanning, synchronization, scrubbing, metrics, a UI, management, and image-trust extensions. Search, UI, and management are enabled by default. This gives operators useful registry controls at the outset while preserving the option to deploy a smaller build.

Storage can use local filesystems or AWS S3, with support for multiple paths and backends. Layer deduplication limits duplicated data; garbage collection and background scrubbing help manage and check stored content. Immutable tags and retention policies add controls for image lifecycle management.

Authentication supports TLS and mTLS, htpasswd, LDAP, bearer tokens, and OpenID/OAuth2 options. Identity-based policies let administrators control actions by user or group at repository or path level. That granularity is valuable for teams sharing a registry across projects, though it also makes Zot a more operator-focused choice than a hosted registry intended to minimize infrastructure work.

Image-security capabilities include vulnerability scanning and cosign and notation signatures. Zot also supports Helm charts, skopeo, cri-o, and Prometheus metrics. Logging, benchmarking with zb, and performance profiling round out the operational tools. The project describes security measures including PIE builds, code-owner reviews, and scans of produced binaries; these measures complement, rather than replace, an organization’s own deployment security practices.

Zot uses OCI Distribution Specification APIs and OCI Image Layout for storage, and is released under Apache License 2.0. The project identifies itself as a CNCF Sandbox Project. The stated deployment fit is currently on-premises, including setups colocated with Kubernetes, so teams seeking a registry for that environment have a clearer fit than those requiring a broadly stated hosted-service offering. Release notes also state that native Windows binaries for amd64 and arm64 are distributed. Support for ORAS artifacts was removed starting with the cited release, a meaningful constraint for teams relying on that artifact workflow.

Pricing

Zot Registry costs nothing. The plan is the Apache 2.0 open-source project, with full or minimal builds; there is no free trial because the software is free to use. That makes it suitable for organizations able to operate and maintain their own registry without a recurring software charge. The trade-off is that the stated fit centers on on-premises deployment rather than a managed service.

The plan includes OCI artifacts, immutable tags, and retention policies. No seat or storage quota is stated for the plan, so teams should assess their own infrastructure capacity rather than assume a hosted allowance.

Platforms

Zot supports API, Linux, macOS, self-hosted, and web environments. Native Windows amd64 and arm64 binaries are also distributed. The combination of single-binary builds and non-root operation suits varied self-managed setups, while the project’s stated deployment focus remains on-premises, including alongside Kubernetes.

Who it's for

Choose Zot if your team runs its own infrastructure and needs an OCI-compatible registry with flexible filesystem or S3 storage, identity-based repository controls, image scanning, and signature support. It is especially relevant for on-premises environments where operators can manage deployment and storage themselves. Look elsewhere if your workflow depends on ORAS artifacts, or if your priority is a managed registry rather than an operator-run deployment.

Pros and cons

Pros

• Flexible deployment: Full and minimal single-binary builds, plus non-root operation, support different on-premises deployment needs.
• Storage controls: Local filesystems and AWS S3, multiple paths, deduplication, garbage collection, and scrubbing give operators options for managing image data.
• Access and image security: Multiple authentication methods, user- and group-based policies, vulnerability scanning, and cosign and notation support cover important registry controls.
• No software charge: The Apache 2.0 project is priced at $0 and includes immutable tags and retention policies.

Cons

• On-premises focus: Its stated deployment fit is on-premises, including Kubernetes-adjacent setups, which is a narrower match for teams seeking a managed registry.
• ORAS artifact support removed: Teams relying on that workflow may need another registry.
• Operator responsibility: The self-hosted approach gives control over infrastructure but requires the team to run it.

Alternatives

Browse container registries to compare other options. Choose Docker Desktop if you want Docker Engine and Kubernetes alongside Docker Hub, Docker Scout, and Docker Debug; its Personal plan is free, with a Pro plan at $9 a month. Inedo ProGet is worth considering for unlimited feeds for private packages and Docker in its free edition, though that edition has limited security and compliance features.

JFrog Container Registry may suit teams seeking a free self-managed option for Docker, OCI, Helm, Helm OCI, and Generic formats, without Xray. 8gears Container Registry offers a free-forever Individuals plan with 1 GB storage, unlimited private repositories, and community support; its Enterprise plan has custom pricing. Chainguard Registry may fit organizations wanting its Free Images plan, capped at five images per organization.

Cosmoner Container Registry is another option. KakaoCloud Container Registry may fit users whose usage aligns with its 30 GiB free outbound allowance and per-GiB charges above that threshold. lazer.sh offers a Hobby plan at $4.99 a month with 100 GB storage, 10 projects, 20 members per project, unlimited repositories and pulls, and no egress fees.

Verdict

Choose Zot if you need a free, standards-based registry that your team can operate on-premises, with flexible storage, fine-grained access policies, and image-security features. Its strongest reason to choose is the breadth of controls available in a self-managed Apache 2.0 project. Look elsewhere if you require ORAS artifact support or want a managed service rather than an operator-run deployment.