SHSelfHostIndex

zot

Production-ready vendor-neutral OCI registry

Developer Tools & Git ★ 2.9k stars Easy setup Apache-2.0

zot is an OCI-native container image registry focused exclusively on the OCI spec. It supports image signing, vulnerability scanning, and a web UI for browsing repositories.

Official siteSource code

Key features

  • OCI-only registry
  • Built-in image scanning
  • Web UI included
  • Image signing support

Strengths

  • Released under the Apache-2.0 license
  • Easy to set up — beginner-friendly
  • First-class Docker support for quick deployment
  • Kubernetes-ready with Helm charts available

Is zot secure?

No known vulnerabilities affect zot's latest release (v2.1.22). OSV.dev lists 5 past advisories for the project; none of them applies to this release. No known vulnerabilities is not proof of security: it means none have been publicly catalogued.

  • Most recent fixed advisory CVE-2026-61833, published 2026-09-18 (26 days ago), fixed in 2.1.18

Source: OSV.dev, checked 2026-10-14. How this is measured.

zot replaces

Self-hosted Docker Hub alternativesSelf-hosted Harbor alternatives

Health badge

Maintain zot? Add its health score to your README. The badge links back to this page.

SelfHostIndex: 90 · excellent

Markdown
[![SelfHostIndex health score for zot](https://selfhostindex.com/badge/zot-registry.svg)](https://selfhostindex.com/app/zot-registry/)
HTML
<a href="https://selfhostindex.com/app/zot-registry/"><img src="https://selfhostindex.com/badge/zot-registry.svg" alt="SelfHostIndex health score for zot"></a>
reStructuredText
.. image:: https://selfhostindex.com/badge/zot-registry.svg
   :alt: SelfHostIndex health score for zot
   :target: https://selfhostindex.com/app/zot-registry/

The score is recomputed on every nightly rebuild from public repository data — see how it is calculated.

Compare zot

4 head-to-head comparisons.

Similar developer tools & git apps