Start here
- Your workloads run in one cloud then use that cloud's registry. In-region pulls are cheap and access control is already solved. → Amazon ECR, Google Artifact Registry, Azure
- You self-host and need scanning, signing and access control → Harbor
- You self-host and Harbor is more than you want to operate → Zot
- You are multi-cloud and want one store → Cloudsmith
- Your real problem is vulnerable base images, not storage → Chainguard
Everything below is detail on those five.
Compare
| Registry | Run by | Scanning | Signing | Replication | Cost from | Score |
|---|---|---|---|---|---|---|
| Harbor | You | Built in | Yes | Yes | Free | 66.6 |
| Zot | You | No | Yes | Yes | Free | 54.1 |
| Distribution | You | No | No | No | Free | 60.3 |
| Pulp | You | No | Yes | Yes | Free | 49.5 |
| Kraken | You | No | No | P2P | Free | 47.8 |
| Amazon ECR | AWS | Built in | Yes | Cross-region | $0.09/mo | 48.8 |
| Google Artifact Registry | Built in | Yes | Multi-region | Usage | 65.9 | |
| Azure Container Registry | Microsoft | Built in | Yes | Geo-replication | Usage | 61.5 |
| Docker Hub | Docker | Paid tiers | Yes | No | $9/mo | 64.4 |
| GitHub Container Registry | GitHub | Via Actions | Yes | No | Free tier | 36.1 |
| GitLab Container Registry | GitLab | Via CI | Yes | No | Free tier | 44.9 |
| Cloudsmith | Cloudsmith | Built in | Yes | Yes | Not published | 63.0 |
| Chainguard | Chainguard | Images rebuilt daily | Yes | Yes | Free tier | 58.8 |
| DigitalOcean | DigitalOcean | No | Yes | No | $0.02/mo | 58.5 |
| IBM Cloud | IBM | Built in | Yes | Yes | Free tier | 53.6 |
| Alibaba Cloud | Alibaba | Built in | Yes | Yes | Free tier | 45.3 |
| Scaleway | Scaleway | No | Yes | No | Not published | 49.2 |
Scores are our composite, 0 to 100. Read them with the confidence figure in each entry below; a low score with low confidence means we could not measure it, not that it is poor.
The three worth reading about
Harbor
Free, Apache-2.0. Shipped 2026-07-02. One advisory ever, none in the last year. Confidence 0.78, the highest here.
The only self-hosted option that ships vulnerability scanning, image signing, replication and role-based access control together. That combination is what turns a registry into something you can show an auditor, and it is why Harbor is the default for regulated teams.
Pick it ifthe registry has to satisfy a compliance requirement and you want to own it. Don't if you are not prepared to run Postgres, Redis and a scanner alongside it.
Zot
Free, Apache-2.0. Shipped 2026-09-06. One moderate advisory, none in the last year. Confidence 0.77.
Deliberately minimal and OCI-native, with no database. This is the real content of zot vs harbor: Harbor does more, Zot gives you less to operate.
Pick it ifyou want a conformant registry and not a platform. Don't if you need scanning or a UI for non-engineers.
Amazon ECR
From $0.09/month. 10 integrations. Confidence 0.73.
Nothing to run, and IAM handles access so you are not maintaining a second identity system. The catch is egress: pulling to compute outside the region, or outside AWS, is where the bill appears.
Pick it ifyour workloads are in AWS. Don't if you pull heavily from another cloud.
Harbor alternatives
By reason for leaving:
| Leaving because | Go to |
|---|---|
| Too heavy to operate | Zot |
| You only need storage | Distribution |
| You want containers and packages in one place | Pulp, or Cloudsmith hosted |
| You want scanning without running anything | any cloud registry above |
| Base images are the actual problem | Chainguard |
| Distributing huge images to thousands of hosts | Kraken |
Nothing matches Harbor feature-for-feature while being simpler. Zot comes closest by doing less on purpose.
Also in this category
| Registry | What it is for | Notes |
|---|---|---|
| Distribution | The reference implementation others build on | Stores images, nothing else. 4 advisories, 3 in the last year |
| Pulp | Containers plus RPM, Debian and Python | GPL-2.0. Worth it only if you want one artefact store |
| Kraken | Peer-to-peer distribution at very large scale | Built for one problem |
| Google Artifact Registry | GCP default, multi-format | Highest-scoring cloud option |
| Azure Container Registry | Azure default, geo-replication | |
| Docker Hub | Where most teams start | Free tier rate-limits CI. $9/mo removes it |
| GitHub Container Registry | Images beside the code | Thin next to a real registry |
| GitLab Container Registry | Same, for GitLab | |
| Cloudsmith | Vendor-neutral, 38 integrations, the most here | Pricing not published |
| Chainguard Registry | Minimal base images, rebuilt for zero known CVEs | A different product wearing the same label |
| DigitalOcean | Cheap, simple | From $0.02/mo |
| IBM Cloud | IBM estates | |
| Alibaba Cloud | Alibaba estates | |
| Scaleway | European hosting | Confidence 0.21, treat as unmeasured |
The costs that are not on the pricing page
Storage per gigabyte is never where registry spend lands.
Egress is. Pulling from a registry in one cloud to compute in another is the expensive path and easy to do by accident. CI pull volume is the multiplier: a pipeline pulling a large base image on every job multiplies whatever your per-pull cost is by your build frequency. Scanning is charged by some and included by others; Harbor includes it and is free.
How we scored this
Signals are properties of the software: licence, release cadence, published advisories, integrations, pricing transparency. No reviews, no company size, no web traffic, no vendor ad spend. Facts retrieved 2026-09-11, pricing observed 2026-09-14, each linked from the product page it came from. We take no payment for placement. Full method · Independence
Three limits on this page. We cannot price egress for your setup, measure scanning quality, or test replication performance, and those decide the choice at scale. Advisory counts exist only for the self-hosted projects, so the hosted registries showing none means nobody publishes them. And our catalogue lists Distribution twice, which we are fixing.