# Chainguard Registry vs CNCF Distribution

| Attribute | Chainguard Registry | CNCF Distribution |
|---|---|---|
| **Vioscale score** | 57.9 (72% (medium)) | 57.6 (66% (medium)) |
| activity.commits_last_30d | - | 8 |
| adoption.dependent_repos | - | 2,403 |
| adoption.github_stars | - | 10,582 |
| deployment.options | `{"cloud":true}` | `{"on_prem":true,"self_hosted":true}` |
| description.long | Secure-by-default container images and open source libraries built from source with SLSA L3 compliance, designed to prevent AI attacks and minimize vulnerability surface in production environments. | Open-source implementation of the OCI Distribution Specification for storing and distributing container images. Enables organizations to tightly control their image storage and distribution pipeline with full ownership of their distribution infrastructure. |
| features.capabilities | `{"web_ui":true,"hosting":"cloud","sbom_support":true,"private_repos":true,"artifact_types":"universal","vulnerability_scanning":true}` | `{"hosting":"self","image_signing":true,"oci_compliant":true,"private_repos":true,"artifact_types":"images"}` |
| integrations.count | 8 | - |
| integrations.list | `[{"name":"Cursor"},{"name":"AWS Security Hub"},{"name":"Wiz"},{"name":"GitHub"},{"name":"GitHub Actions"},{"name":"npm"},{"name":"SAP Cloud Application Programming Model"},{"name":"Kubernetes"}]` | - |
| language.primary | - | Go |
| license.spdx | - | Apache-2.0 |
| market.availability | `{"primaryMarkets":["US"],"availabilityScope":"global","availableCountries":[],"notAvailableCountries":[]}` | - |
| platform.support | `{"cli":true,"web":true}` | - |
| pricing | `{"type":"hybrid","plans":[{"free":false,"name":"Catalog Pricing","features":["Unlimited image catalog access","All 10,000+ underlying packages","Custom Assembly for image customization","Private APK Repositories","EOL Grace Period (6 months extended support)"],"description":"Unlimited access to entire image catalog of 1,400+ images and 10,000+ packages with 50-100 new images built monthly. Scales based on containerized engineering organization size.","contactSales":true},{"free":false,"name":"Per-Image Pricing","features":["Specific image selection","Custom Assembly","Private APK Repositories"],"description":"Targeted pricing model for organizations with fixed application stacks or focused adoption","contactSales":true}],"summary":"Contact sales for quote. Free tier available with limited catalog access.","currency":"USD","freeTier":true,"sourceUrl":"https://www.chainguard.dev/unchained/unlock-the-full-chainguard-containers-catalog-now-with-a-catalog-pricing-option","retrievedAt":"2026-08-13T18:17:50.440Z"}` | `{"type":"open_source","sourceUrl":"https://distribution.github.io/distribution/","retrievedAt":"2026-08-13T18:17:59.377Z"}` |
| pricing.free_tier | yes | - |
| pricing.model | quote | open_source |
| pricing.price_level | low | free |
| pricing.transparent | no | - |
| release.cadence_days | - | 55 |
| release.history | - | `[{"url":"https://github.com/distribution/distribution/releases/tag/v3.1.1","date":"2026-05-01T15:51:50Z","type":"stable","version":"v3.1.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.1.0","date":"2026-04-06T17:09:31Z","type":"stable","version":"v3.1.0"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0","date":"2025-04-03T06:25:36Z","type":"stable","version":"v3.0.0"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-rc.4","date":"2025-03-22T14:59:29Z","type":"prerelease","version":"v3.0.0-rc.4"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-rc.3","date":"2025-02-11T16:21:07Z","type":"prerelease","version":"v3.0.0-rc.3"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-rc.2","date":"2024-12-18T15:23:19Z","type":"prerelease","version":"v3.0.0-rc.2"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-rc.1","date":"2024-11-07T21:04:41Z","type":"prerelease","version":"v3.0.0-rc.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-beta.1","date":"2024-07-10T13:22:40Z","type":"prerelease","version":"v3.0.0-beta.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-alpha.1","date":"2023-12-19T16:03:36Z","type":"prerelease","version":"v3.0.0-alpha.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.3","date":"2023-10-02T18:23:54Z","type":"stable","version":"v2.8.3"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.2","date":"2023-05-11T10:47:43Z","type":"stable","version":"v2.8.2"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.2-beta.2","date":"2023-05-09T23:32:56Z","type":"prerelease","version":"v2.8.2-beta.2"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.2-beta.1","date":"2023-05-09T22:42:12Z","type":"prerelease","version":"v2.8.2-beta.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.1","date":"2022-03-08T18:19:10Z","type":"stable","version":"v2.8.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.0","date":"2022-02-07T15:53:07Z","type":"stable","version":"v2.8.0"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.0-beta.1","date":"2022-01-21T16:49:13Z","type":"prerelease","version":"v2.8.0-beta.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.7.1","date":"2019-01-17T23:22:32Z","type":"stable","version":"v2.7.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.7.0","date":"2018-12-04T00:20:01Z","type":"stable","version":"v2.7.0"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.7.0-rc.0","date":"2018-09-28T23:23:36Z","type":"prerelease","version":"v2.7.0-rc.0"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.6.2","date":"2017-07-20T21:20:00Z","type":"stable","version":"v2.6.2"}]` |
| reliability.status_page | yes | yes |
| security.fedramp | yes | - |
| security.gdpr | yes | - |
| security.hipaa | yes | - |
| security.pci | yes | - |
| security.scorecard | - | 7.9 |
| security.soc2 | yes | - |
| security.vulnerabilities | - | `{"count":4,"source":"https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=go&package_name=github.com%2Fdistribution%2Fdistribution%2Fv3&per_page=100","last_12m":3,"max_severity":"HIGH"}` |

## Capabilities (Container Registries)

| Capability | Chainguard Registry | CNCF Distribution |
|---|:--:|:--:|
| **Deployment** |  |  |
| Hosting | Cloud only | Self-hosted only |
| **Standards** |  |  |
| OCI Distribution Spec compliant | - | ✓ |
| **Scope** |  |  |
| Artifact types | Universal (images + language packages) | Container images only |
| **Security** |  |  |
| Built-in vulnerability scanning | ✓ | - |
| Image signing (Cosign/Notation) | - | ✓ |
| SBOM generation / storage | ✓ | - |
| **Access** |  |  |
| Fine-grained RBAC / robot accounts | - | - |
| Private repositories | ✓ | ✓ |
| **Distribution** |  |  |
| Geo-replication / mirroring | - | - |
| Pull-through cache / proxy | - | - |
| **Integration** |  |  |
| Native cloud IAM integration | - | - |
| **Pricing** |  |  |
| Pull-rate limits | - | - |
| **UX** |  |  |
| Web UI / console | ✓ | - |
| **Ops** |  |  |
| High-availability deployment | - | - |

*Source: Vioscale. Generated 2026-09-01T17:17:53.233Z. "-" = undocumented, not absent.*