zot
SHA-256zot is a production-ready, vendor-neutral OCI image registry. It stores images in OCI format and implements the distribution specification on the wire. Lightweight single-binary, no external dependencies.
Smart Download
Download Download Version
v2.1.16 · 304.3 MB
Lightweight, vendor-neutral OCI registry — simpler and faster than Docker Registry.
Core Features
- Fully OCI-compliant (image & distribution specs), drop-in replacement for Docker Registry
- Single binary, zero external dependencies, easy to deploy
- Built-in garbage collection, multi-architecture support, web UI
- Multiple storage backends: local filesystem, S3, Azure Blob
- Extensible vulnerability scanning (external), image signing & authentication
What It Can't Do
- •No authentication by default; configure HTTPS with basic auth or OIDC in production. 2. Built-in web UI is basic; use CLI for complex management. 3. S3 backend may suffer from network latency/storage throttling.
Use Cases
- Private container registry in enterprise replacing Docker Registry
- Lightweight image management on edge devices or resource-constrained environments
- Fast push/pull in CI/CD pipelines
Detailed Introduction
zot is a lightweight, high-performance OCI image registry written in Go. It is fully compliant with the Open Container Initiative (OCI) image specification and distribution specification, making it a drop-in replacement for Docker Registry or other container registries. With built-in garbage collection, multi-architecture support, and a minimal footprint, zot is designed for both edge and cloud deployments. It includes a built-in web UI, vulnerability scanning (via external tools), and supports storage backends like local filesystem, S3, and Azure Blob. zot emphasizes simplicity, security, and efficiency, with a focus on being truly vendor-neutral. It has no external dependencies and is easy to run as a single binary.
Troubleshooting & FAQ (1)
TroubleshootingWhy does docker push to zot registry fail with 'unauthorized: authentication required' when anonymous access is enabled?
This is a known bug in zot v2.1.10 and earlier, where enabling anonymous read access (anonymousPolicy: ["read"]) causes Docker CLI to fail authentication on push. The issue has been fixed via PRs #3868 and #3992. Upgrade to zot v2.1.11 or later. Temporary workaround: disable anonymous access or use a reverse proxy that adds missing auth headers (e.g., zot-docker-proxy).
Tags
Getting Started
Download installer
Click the button above to download the installer for your system
Install the software
Double-click the downloaded installer and follow the prompts
Step 1: Download the binary from GitHub Releases (or use Docker image)
Step 2: Create a config file (e.g., config.json) specifying storage path and port
Step 3: Run `./zot serve config.json`
- Step 1: Download the binary from GitHub Releases (or use Docker image)
- Step 2: Create a config file (e.g., config.json) specifying storage path and port
- Step 3: Run `./zot serve config.json`
SHA-256 checksum verified
Checksum extracted from GitHub official Release page
SHA256 Checksum
ab62c56dba7f7a9db0187eeaca6353c0c2586009cb7a09a31fc8cc1ca810b596This checksum is extracted from the GitHub Release page. Verify file integrity after download.
All SHA-256 checksums on this platform are extracted from the project's official GitHub Release page, without any modification. You can independently verify them on the GitHub Releases page.
Open Source Transparency
View GitHub SourceUninstall Info
Delete the binary and configuration directory. For persistent storage, delete the storage directory manually.
No Extra Dependencies
Ready to use after download. No additional runtime required.
Having issues? Check the FAQ below
1 FAQ
Similar Projects
PowerToys
A set of utilities for power users to tune and streamline their Windows experience for greater productivity.
terminal
Modern, feature-rich terminal application for Windows command-line users, with tabs, GPU acceleration, and full customization.
core
Open source home automation that puts local control and privacy first. Perfect for Raspberry Pi or a local server.