Learn about Zot, the open-source OCI-native container registry, its single-binary architecture, key features, and CNCF Sandbox status.
Zot is an open-source, vendor-neutral, OCI-native container image and artifact registry, built purely on the OCI Distribution and Image Specifications rather than a proprietary internal format.
The project is a CNCF Sandbox Project, accepted on December 13, 2022, with the Linux Foundation holding trademark rights and Cisco noted as a sponsor and adopter in the project's ecosystem.
Unlike heavier registry platforms that require multiple services or external databases, Zot ships as a single, statically built binary with no external dependencies, making it easy to deploy anywhere from cloud infrastructure to edge devices.
Zot bundles security scanning, authentication, authorization, garbage collection, and deduplication directly into the single binary, avoiding the need for separate add-on services.
It supports OCI artifacts beyond container images, including Helm charts, SBOMs, and image signatures, making it useful as a general artifact store for cloud-native supply chains.
Two build variants are available: a full-featured build and a minimal, security-hardened build for constrained or high-assurance environments.
It works seamlessly with standard container tooling such as Docker pull commands, Podman, runc, and Helm, requiring no changes to existing client workflows.
Zot is free and open source under the Apache 2.0 license, with no paid tiers or commercial licensing from the project itself.
Because it is self-hosted, actual cost depends on the infrastructure used to run it, ranging from a Raspberry Pi to production cloud servers.
Support is community-driven through GitHub issues, Slack channels, and official documentation rather than a paid support contract.
Yes, Zot is free and open source under the Apache 2.0 license; costs are limited to whatever infrastructure you use to host it.
Zot was accepted as a CNCF Sandbox Project on December 13, 2022, with the Linux Foundation holding trademark rights over the project.
Yes, Zot supports standard Docker pull and push workflows as well as Podman, runc, and Helm.
Zot supports Helm charts, software bills of materials (SBOMs), and image signatures alongside standard container images.
Yes, its single-binary architecture with no external dependencies allows it to run on lightweight hardware including a Raspberry Pi.
Yes, vulnerability and security scanning are built directly into the binary rather than requiring a separate service.
Zot supports HTTP Basic authentication, LDAP, and HTTP Bearer token authentication.
Zot is maintained as an open-source community project under the project-zot GitHub organization, with Cisco noted as a sponsor and adopter, under CNCF Sandbox governance.