A fully OCI-compliant and Docker-compatible container registry.
- Online garbage collection
- Pull-through cache
- Immutable tags with configurable exclusions
- Access control policies (CEL-based)
- Retention policies
- Native mTLS support
- OIDC authentication (GitHub Actions, Google, Okta, and more)
- Webhook authorization for external policy decisions
- Web UI for browsing and managing images
- Resource efficient: Asynchronous, streaming operations
- Secure: mTLS, OIDC/JWT authentication, authorization policies (CEL and webhooks)
- Scalable: Light footprint, S3-compatible storage, distributed locking
- Easy to operate: Online garbage collection, auto-reload of configuration and certificates
- Cross-platform: Portable on most mainstream operating systems just by recompiling
# Create a minimal config
cat > config.toml << 'EOF'
[server]
bind_address = "0.0.0.0"
port = 8000
[blob_store.fs]
root_dir = "./registry-data"
[global.access_policy]
default = "allow"
[repository."test"]
EOF
# Run the registry
./angos -c config.toml server
# Push an image
docker tag alpine:latest localhost:8000/test/alpine:latest
docker push localhost:8000/test/alpine:latestSee the Quickstart Tutorial for a complete walkthrough.
The complete documentation index lives in doc/index.md.
- Quickstart - Get a registry running in 5 minutes
- Your First Private Registry - Add authentication and access control
- Mirror Docker Hub - Set up a pull-through cache
- Deploy with Docker Compose
- Deploy on Kubernetes
- Configure mTLS
- Configure GitHub Actions OIDC
- Configure Generic OIDC
- Set Up Access Control
- Configure Retention Policies
- Protect Tags with Immutability
- Configure Webhook Authorization
- Configure Event Webhooks
- Configure Replication
- Run Storage Maintenance
- Enable Durable Cache Jobs
- Enable the Web UI
- Troubleshoot Common Issues
- Upgrade Angos
- Configuration Reference
- CLI Reference
- CEL Expressions Reference
- API Endpoints Reference
- Web UI Reference
- Event Webhooks Reference
- Metrics Reference
- Architecture Overview
- Storage Backends
- Authentication and Authorization
- Pull-Through Caching
- Bi-Directional Replication
- Security Model
Version-specific migration notes are in the Upgrade guide.
Usage: angos [-c <config>] <command> [<args>]
An OCI-compliant and docker-compatible registry service
Options:
-c, --config the path to the configuration file, defaults to
`config.toml`
--help, help display usage information
Commands:
argon Hash a password following the argon2id algorithm
migrate Convert pre-JSON bare-digest link metadata to the current
JSON format
prune Enforce retention policies and reclaim aged upload-lifecycle
leftovers
replicate Reconcile replicated namespaces with their configured
downstreams
scrub Walk the store, repair inconsistencies, and quarantine
unrecognized objects
server Run the registry listeners
worker Process durable background jobs
In addition to the standard OCI Distribution endpoints:
/healthz: Liveness health check endpoint/readyz: Readiness health check endpoint/metrics: Prometheus metrics endpoint