Private Registry

Stores and serves Open Container Initiative (OCI) artifacts, including container images, Helm charts, and model weights, using a standardized API. This ensures compatibility with all OCI-compliant clients like Docker, Podman, and Kubernetes.

• Content-Addressable Storage: Images are stored as content-addressable layers identified by SHA256 digests, enabling deduplication and tamper detection.
• Multi-Architecture Manifests: Supports manifest lists that allow a single image tag to resolve to the correct binary for amd64, arm64, or ppc64le nodes.
• Garbage Collection: Automated policies reclaim storage by deleting unreferenced blobs and untagged manifests, critical for managing large model artifacts.

Integrates with static analysis engines to scan every pushed image layer for known Common Vulnerabilities and Exposures (CVEs) before they can be deployed.

• Admission Control: Prevents pulling images with critical or high-severity vulnerabilities based on configurable thresholds.
• Continuous Rescanning: Automatically rescans existing images when new CVEs are published, notifying security teams of newly discovered risks in previously approved artifacts.
• SBOM Generation: Produces a Software Bill of Materials for each image, cataloging all OS packages and language dependencies for compliance audits.

Enables pull-based and push-based replication of artifacts between registries, which is essential for bridging connected build environments and air-gapped production clusters.

• Filtered Replication: Replicates only specific repositories or image tags matching defined glob patterns, preventing the transfer of development artifacts to secure environments.
• Proxy Cache: Operates as a pull-through cache for external registries like Docker Hub or NVIDIA NGC, storing requested images locally for subsequent air-gapped transfer.
• Incremental Synchronization: Transfers only the missing layers and manifests, minimizing the data volume required for periodic updates to a disconnected registry.

Enforces granular permissions on registry operations, integrating with enterprise identity providers via LDAP, OIDC, or SAML.

• Project-Level Isolation: Segments artifacts into projects or namespaces, each with independent user and robot account permissions.
• Immutable Tags: Locks specific image tags to prevent overwriting, ensuring that production deployments always reference a known, auditable artifact.
• Audit Logging: Records every operation—push, pull, delete—with user identity and timestamp for forensic analysis and compliance reporting.

Deploys in a stateless, horizontally scalable configuration where all metadata and artifacts reside on external, fault-tolerant storage.

• Pluggable Storage: Supports object stores like AWS S3, MinIO, and Azure Blob Storage, as well as filesystem-based persistent volumes for on-premises deployments.
• Read-Only Replicas: Distributes read-only registry instances geographically to serve pull traffic closer to compute nodes, reducing latency for large model downloads.
• Database Resilience: Uses an external PostgreSQL database for metadata, enabling standard backup, failover, and point-in-time recovery procedures.

Automates the cleanup of old or unused artifacts to control storage costs and enforce governance standards.

• Tag-Based Retention: Retains the last N images per repository or those matching specific tag patterns like prod-* while pruning development snapshots.
• Conditional Pruning: Removes images that have not been pulled within a defined time window, indicating they are no longer actively used by any workload.
• Quota Management: Sets per-project storage limits to prevent a single team or workload from consuming disproportionate registry capacity.