# CNCF Distribution vs Zot

**Leader by vioscaleAI score:** CNCF Distribution

| Attribute | CNCF Distribution | Zot |
|---|---|---|
| **vioscaleAI score** | 66.3 (66% (medium)) | 53.6 (75% (high)) |
| activity.commits_last_30d | 63 | 67 |
| adoption.dependent_repos | 2,403 | 0 |
| adoption.github_stars | 10,646 | 2,865 |
| content.faq | `[{"answer":"Open-source implementation of the OCI Distribution Specification for storing and distributing container images. Enables organizations to tightly control their image storage and distribution pipeline with full ownership of their distribution infrastructure. It is indexed under Container Registries.","source":"https://distribution.github.io/distribution/","question":"What is CNCF Distribution?","confidence":0.6},{"answer":"CNCF Distribution is open source, so it can be self-hosted and used at no licence cost. It is released under the Apache-2.0 licence. Pricing changes often, so verify at source before relying on it.","source":"https://distribution.github.io/distribution/","question":"Is CNCF Distribution free to use?","confidence":0.6},{"answer":"Yes. CNCF Distribution can be deployed on-premise and self-hosted, so it does not have to run on the vendor's infrastructure.","source":"https://distribution.github.io/distribution/","question":"Can CNCF Distribution be self-hosted?","confidence":0.6},{"answer":"Yes. CNCF Distribution is published under the Apache-2.0 licence, a permissive licence that generally allows commercial use and modification. Licence terms can change between releases, so verify against the repository for the version you intend to use.","source":"https://github.com/distribution/distribution","question":"Is CNCF Distribution open source?","confidence":0.95}]` | `[{"answer":"A lightweight, self-contained registry for managing container images that fully implements OCI standards. It runs as a single binary without elevated privileges and includes built-in security scanning, access control, garbage collection, and image deduplication. It is indexed under Container Registries.","source":"https://zotregistry.dev","question":"What is Zot?","confidence":0.6},{"answer":"Zot is open source, so it can be self-hosted and used at no licence cost. It is released under the Apache-2.0 licence. Pricing changes often, so verify at source before relying on it.","source":"https://zotregistry.dev","question":"Is Zot free to use?","confidence":0.6},{"answer":"Zot supports macOS, Linux and a command-line interface. Platforms we have not confirmed are simply not listed here rather than ruled out.","source":"https://zotregistry.dev","question":"What platforms does Zot support?","confidence":0.6},{"answer":"Yes. Zot can be deployed cloud / SaaS and self-hosted, so it does not have to run on the vendor's infrastructure.","source":"https://zotregistry.dev","question":"Can Zot be self-hosted?","confidence":0.6},{"answer":"Yes. Zot is published under the Apache-2.0 licence, a permissive licence that generally allows commercial use and modification. Licence terms can change between releases, so verify against the repository for the version you intend to use.","source":"https://github.com/project-zot/zot","question":"Is Zot open source?","confidence":0.95}]` |
| deployment.options | `{"cloud":true}` | `{"cloud":true,"self_hosted":true}` |
| description.long | Docker Hub enables developers to push, pull, and manage container images with their teams, automate builds and deployments through webhooks, and control access to repositories. | A lightweight, self-contained registry for managing container images that fully implements OCI standards. It runs as a single binary without elevated privileges and includes built-in security scanning, access control, garbage collection, and image deduplication. |
| features.capabilities | `{"rbac":true,"web_ui":true,"hosting":"self","image_signing":true,"oci_compliant":true,"private_repos":true,"artifact_types":"images","vulnerability_scanning":true}` | `{"rbac":true,"hosting":"both","oci_compliant":true,"private_repos":true,"artifact_types":"images","vulnerability_scanning":true}` |
| integrations.count | - | 1 |
| integrations.list | - | `[{"name":"Stacker"}]` |
| language.primary | Go | Go |
| license.spdx | Apache-2.0 | Apache-2.0 |
| platform.support | `{"web":true}` | `{"cli":true,"mac":true,"linux":true}` |
| pricing | `{"type":"subscription","freeTier":true,"sourceUrl":"https://distribution.github.io/distribution/","retrievedAt":"2026-09-10T21:11:49.107Z"}` | `{"type":"open_source","freeTier":true,"sourceUrl":"https://zotregistry.dev","retrievedAt":"2026-08-03T13:02:43.251Z"}` |
| pricing.free_tier | yes | yes |
| pricing.model | freemium | open_source |
| pricing.price_level | low | free |
| pricing.transparent | - | yes |
| release.cadence_days | 55 | 31 |
| release.history | `[{"url":"https://github.com/distribution/distribution/releases/tag/v3.1.2","date":"2026-09-24T12:21:27Z","type":"stable","version":"v3.1.2"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.1.1","date":"2026-05-01T15:51:50Z","type":"stable","version":"v3.1.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.1.0","date":"2026-04-06T17:09:31Z","type":"stable","version":"v3.1.0"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0","date":"2025-04-03T06:25:36Z","type":"stable","version":"v3.0.0"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-rc.4","date":"2025-03-22T14:59:29Z","type":"prerelease","version":"v3.0.0-rc.4"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-rc.3","date":"2025-02-11T16:21:07Z","type":"prerelease","version":"v3.0.0-rc.3"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-rc.2","date":"2024-12-18T15:23:19Z","type":"prerelease","version":"v3.0.0-rc.2"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-rc.1","date":"2024-11-07T21:04:41Z","type":"prerelease","version":"v3.0.0-rc.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-beta.1","date":"2024-07-10T13:22:40Z","type":"prerelease","version":"v3.0.0-beta.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-alpha.1","date":"2023-12-19T16:03:36Z","type":"prerelease","version":"v3.0.0-alpha.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.3","date":"2023-10-02T18:23:54Z","type":"stable","version":"v2.8.3"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.2","date":"2023-05-11T10:47:43Z","type":"stable","version":"v2.8.2"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.2-beta.2","date":"2023-05-09T23:32:56Z","type":"prerelease","version":"v2.8.2-beta.2"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.2-beta.1","date":"2023-05-09T22:42:12Z","type":"prerelease","version":"v2.8.2-beta.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.1","date":"2022-03-08T18:19:10Z","type":"stable","version":"v2.8.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.0","date":"2022-02-07T15:53:07Z","type":"stable","version":"v2.8.0"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.0-beta.1","date":"2022-01-21T16:49:13Z","type":"prerelease","version":"v2.8.0-beta.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.7.1","date":"2019-01-17T23:22:32Z","type":"stable","version":"v2.7.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.7.0","date":"2018-12-04T00:20:01Z","type":"stable","version":"v2.7.0"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.7.0-rc.0","date":"2018-09-28T23:23:36Z","type":"prerelease","version":"v2.7.0-rc.0"}]` | `[{"url":"https://github.com/project-zot/zot/releases/tag/v2.1.22","date":"2026-10-06T16:50:05Z","type":"stable","version":"v2.1.22"},{"url":"https://github.com/project-zot/zot/releases/tag/v2.1.21","date":"2026-09-06T18:44:38Z","type":"stable","version":"v2.1.21"},{"url":"https://github.com/project-zot/zot/releases/tag/v2.1.20","date":"2026-08-04T17:51:30Z","type":"stable","version":"v2.1.20"},{"url":"https://github.com/project-zot/zot/releases/tag/v2.1.19","date":"2026-08-04T06:46:22Z","type":"stable","version":"v2.1.19"},{"url":"https://github.com/project-zot/zot/releases/tag/v2.1.18","date":"2026-06-24T15:30:19Z","type":"stable","version":"v2.1.18"},{"url":"https://github.com/project-zot/zot/releases/tag/v2.1.17","date":"2026-05-18T05:44:37Z","type":"stable","version":"v2.1.17"},{"url":"https://github.com/project-zot/zot/releases/tag/v2.1.16","date":"2026-04-19T06:26:29Z","type":"stable","version":"v2.1.16"},{"url":"https://github.com/project-zot/zot/releases/tag/v2.1.15","date":"2026-03-08T22:31:57Z","type":"stable","version":"v2.1.15"},{"url":"https://github.com/project-zot/zot/releases/tag/v2.1.14","date":"2026-01-25T17:14:38Z","type":"stable","version":"v2.1.14"},{"url":"https://github.com/project-zot/zot/releases/tag/v2.1.13","date":"2025-12-23T10:14:48Z","type":"stable","version":"v2.1.13"},{"url":"https://github.com/project-zot/zot/releases/tag/v2.1.12","date":"2025-12-21T20:45:14Z","type":"stable","version":"v2.1.12"},{"url":"https://github.com/project-zot/zot/releases/tag/v2.1.11","date":"2025-11-20T20:14:44Z","type":"stable","version":"v2.1.11"},{"url":"https://github.com/project-zot/zot/releases/tag/v2.1.10","date":"2025-10-18T18:46:36Z","type":"stable","version":"v2.1.10"},{"url":"https://github.com/project-zot/zot/releases/tag/v2.1.9","date":"2025-10-14T16:18:49Z","type":"stable","version":"v2.1.9"},{"url":"https://github.com/project-zot/zot/releases/tag/v2.1.8","date":"2025-09-01T19:20:42Z","type":"stable","version":"v2.1.8"},{"url":"https://github.com/project-zot/zot/releases/tag/v2.1.7","date":"2025-08-03T16:35:59Z","type":"stable","version":"v2.1.7"},{"url":"https://github.com/project-zot/zot/releases/tag/v2.1.6","date":"2025-07-27T01:14:14Z","type":"stable","version":"v2.1.6"},{"url":"https://github.com/project-zot/zot/releases/tag/v2.1.5","date":"2025-06-17T18:04:11Z","type":"stable","version":"v2.1.5"},{"url":"https://github.com/project-zot/zot/releases/tag/v2.1.4","date":"2025-06-06T02:31:04Z","type":"stable","version":"v2.1.4"},{"url":"https://github.com/project-zot/zot/releases/tag/v2.1.3","date":"2025-05-22T17:04:49Z","type":"stable","version":"v2.1.3"}]` |
| reliability.status_page | yes | - |
| security.scorecard | 7.6 | 8 |
| security.vulnerabilities | `{"count":4,"source":"https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=go&package_name=github.com%2Fdistribution%2Fdistribution%2Fv3&per_page=100","last_12m":3,"max_severity":"HIGH"}` | `{"count":1,"source":"https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=go&package_name=zotregistry.io%2Fzot&per_page=100","last_12m":0,"max_severity":"MODERATE"}` |

## Capabilities (Container Registries)

| Capability | CNCF Distribution | Zot |
|---|:--:|:--:|
| **Deployment** |  |  |
| Hosting | Self-hosted only | Cloud + self-hosted |
| **Standards** |  |  |
| OCI Distribution Spec compliant | ✓ | ✓ |
| **Scope** |  |  |
| Artifact types | Container images only | Container images only |
| **Security** |  |  |
| Built-in vulnerability scanning | ✓ | ✓ |
| Image signing (Cosign/Notation) | ✓ | - |
| SBOM generation / storage | - | - |
| **Access** |  |  |
| Fine-grained RBAC / robot accounts | ✓ | ✓ |
| Private repositories | ✓ | ✓ |
| **Distribution** |  |  |
| Geo-replication / mirroring | - | - |
| Pull-through cache / proxy | - | - |
| **Integration** |  |  |
| Native cloud IAM integration | - | - |
| **Pricing** |  |  |
| Pull-rate limits | - | - |
| **UX** |  |  |
| Web UI / console | ✓ | - |
| **Ops** |  |  |
| High-availability deployment | - | - |

*Source: vioscaleAI. Generated 2026-10-16T19:05:23.099Z. "-" = undocumented, not absent.*