Container registry
Nobody should get paged by a pull limit
Unlimited pulls, authenticated or not. Layer-level deduplication across your whole organisation. Scanning on push, with results attached to the manifest.
What a registry should do
Pull without ceremony
No rate limit, no token dance for public images, no daily quota that resets in the middle of your deploy.
Layers stored once
Identical layers across teams, tags and repositories are stored once and billed once. Typical saving: 3.9×.
Scan on push
Vulnerability and secret scanning finish before the tag is usable, with results attached as an OCI referrer.
Pull-through cache
Proxy any upstream registry. Your cluster pulls once from the internet and locally thereafter.
Signing and attestations
Cosign signatures, SBOMs and provenance stored as referrers and verified by an admission policy you configure.
Retention that is not a footgun
Rules by tag pattern, age and pull recency — with a dry run that shows exactly what would be deleted.
Reality check
Where the daily terabytes actually come from
It is almost never humans. A mid-size platform team pulls far more than it pushes, and most of it is machines doing exactly what they were told.
- CI: 41,000 pipeline runs a day, each pulling a base image
- Kubernetes: 900 nodes, image pulls on every rollout
- Pull-through cache filling for upstream bases
- Developers: about 2% of total volume