# Cloudsmith vs CNCF Distribution

**Leader by Vioscale score:** Cloudsmith

| Attribute | Cloudsmith | CNCF Distribution |
|---|---|---|
| **Vioscale score** | 66.4 (52% (medium)) | 57.6 (66% (medium)) |
| activity.commits_last_30d | - | 8 |
| adoption.dependent_repos | - | 2,403 |
| adoption.github_stars | - | 10,582 |
| deployment.options | `{"cloud":true}` | `{"on_prem":true,"self_hosted":true}` |
| description.long | Universal artifact management solution for controlling, securing, and distributing packages and containers in your software supply chain with supply chain security, observability, and analytics. | Open-source implementation of the OCI Distribution Specification for storing and distributing container images. Enables organizations to tightly control their image storage and distribution pipeline with full ownership of their distribution infrastructure. |
| features.capabilities | `{"web_ui":true,"hosting":"cloud","sbom_support":true,"image_signing":true,"oci_compliant":true,"private_repos":true,"artifact_types":"universal","cloud_iam_native":true,"pull_rate_limits":"tiered","pull_through_cache":true,"replication_mirroring":true,"vulnerability_scanning":true}` | `{"hosting":"self","image_signing":true,"oci_compliant":true,"private_repos":true,"artifact_types":"images"}` |
| integrations.count | 37 | - |
| integrations.list | `[{"name":"AWS CodeBuild"},{"name":"Aikido"},{"name":"Ansible"},{"name":"Argo CD"},{"name":"Azure AD SSO"},{"name":"Azure DevOps"},{"name":"Bitbucket Pipelines"},{"name":"Buildkite"},{"name":"Chainguard"},{"name":"Chef"},{"name":"CircleCI"},{"name":"Codefresh"},{"name":"Datadog"},{"name":"Dependabot"},{"name":"Drone CI"},{"name":"GitHub Actions"},{"name":"GitHub Secret Scanning"},{"name":"GitLab CI/CD"},{"name":"Google SSO"},{"name":"Harness"},{"name":"Jenkins"},{"name":"JumpCloud SSO"},{"name":"Kusari"},{"name":"Microsoft Teams"},{"name":"Octopus Deploy"},{"name":"Okta"},{"name":"OneLogin SSO"},{"name":"Ping Identity"},{"name":"Puppet"},{"name":"Roadie"},{"name":"Semaphore CI"},{"name":"Slack"},{"name":"Terraform Provider"},{"name":"Travis CI"},{"name":"VS Code Extension"},{"name":"Webhooks"},{"name":"Zapier"}]` | - |
| language.primary | - | Go |
| license.spdx | - | Apache-2.0 |
| market.availability | `{"hqCountry":"GB","primaryMarkets":[],"availabilityScope":"global","availableCountries":[],"notAvailableCountries":[]}` | - |
| platform.support | `{"cli":true,"web":true}` | - |
| pricing | - | `{"type":"open_source","sourceUrl":"https://distribution.github.io/distribution/","retrievedAt":"2026-08-13T18:17:59.377Z"}` |
| pricing.model | commercial | open_source |
| pricing.price_level | - | free |
| release.cadence_days | - | 55 |
| release.history | - | `[{"url":"https://github.com/distribution/distribution/releases/tag/v3.1.1","date":"2026-05-01T15:51:50Z","type":"stable","version":"v3.1.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.1.0","date":"2026-04-06T17:09:31Z","type":"stable","version":"v3.1.0"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0","date":"2025-04-03T06:25:36Z","type":"stable","version":"v3.0.0"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-rc.4","date":"2025-03-22T14:59:29Z","type":"prerelease","version":"v3.0.0-rc.4"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-rc.3","date":"2025-02-11T16:21:07Z","type":"prerelease","version":"v3.0.0-rc.3"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-rc.2","date":"2024-12-18T15:23:19Z","type":"prerelease","version":"v3.0.0-rc.2"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-rc.1","date":"2024-11-07T21:04:41Z","type":"prerelease","version":"v3.0.0-rc.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-beta.1","date":"2024-07-10T13:22:40Z","type":"prerelease","version":"v3.0.0-beta.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-alpha.1","date":"2023-12-19T16:03:36Z","type":"prerelease","version":"v3.0.0-alpha.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.3","date":"2023-10-02T18:23:54Z","type":"stable","version":"v2.8.3"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.2","date":"2023-05-11T10:47:43Z","type":"stable","version":"v2.8.2"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.2-beta.2","date":"2023-05-09T23:32:56Z","type":"prerelease","version":"v2.8.2-beta.2"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.2-beta.1","date":"2023-05-09T22:42:12Z","type":"prerelease","version":"v2.8.2-beta.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.1","date":"2022-03-08T18:19:10Z","type":"stable","version":"v2.8.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.0","date":"2022-02-07T15:53:07Z","type":"stable","version":"v2.8.0"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.0-beta.1","date":"2022-01-21T16:49:13Z","type":"prerelease","version":"v2.8.0-beta.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.7.1","date":"2019-01-17T23:22:32Z","type":"stable","version":"v2.7.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.7.0","date":"2018-12-04T00:20:01Z","type":"stable","version":"v2.7.0"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.7.0-rc.0","date":"2018-09-28T23:23:36Z","type":"prerelease","version":"v2.7.0-rc.0"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.6.2","date":"2017-07-20T21:20:00Z","type":"stable","version":"v2.6.2"}]` |
| reliability.status_page | yes | yes |
| security.disclosure_policy | yes | - |
| security.iso27001 | yes | - |
| security.scorecard | - | 7.9 |
| security.soc2 | yes | - |
| security.vulnerabilities | - | `{"count":4,"source":"https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=go&package_name=github.com%2Fdistribution%2Fdistribution%2Fv3&per_page=100","last_12m":3,"max_severity":"HIGH"}` |

## Capabilities (Container Registries)

| Capability | Cloudsmith | CNCF Distribution |
|---|:--:|:--:|
| **Deployment** |  |  |
| Hosting | Cloud only | Self-hosted only |
| **Standards** |  |  |
| OCI Distribution Spec compliant | ✓ | ✓ |
| **Scope** |  |  |
| Artifact types | Universal (images + language packages) | Container images only |
| **Security** |  |  |
| Built-in vulnerability scanning | ✓ | - |
| Image signing (Cosign/Notation) | ✓ | ✓ |
| SBOM generation / storage | ✓ | - |
| **Access** |  |  |
| Fine-grained RBAC / robot accounts | - | - |
| Private repositories | ✓ | ✓ |
| **Distribution** |  |  |
| Geo-replication / mirroring | ✓ | - |
| Pull-through cache / proxy | ✓ | - |
| **Integration** |  |  |
| Native cloud IAM integration | ✓ | - |
| **Pricing** |  |  |
| Pull-rate limits | Tiered by plan | - |
| **UX** |  |  |
| Web UI / console | ✓ | - |
| **Ops** |  |  |
| High-availability deployment | - | - |

*Source: Vioscale. Generated 2026-09-01T14:25:38.232Z. "-" = undocumented, not absent.*