# CNCF Distribution vs Pulp

**Leader by Vioscale score:** CNCF Distribution

| Attribute | CNCF Distribution | Pulp |
|---|---|---|
| **Vioscale score** | 57.6 (66% (medium)) | 43.7 (60% (medium)) |
| activity.commits_last_30d | 8 | 49 |
| adoption.dependent_repos | 2,403 | 65 |
| adoption.github_stars | 10,582 | 586 |
| deployment.options | `{"on_prem":true,"self_hosted":true}` | `{"cloud":true,"on_prem":true,"self_hosted":true}` |
| description.long | Open-source implementation of the OCI Distribution Specification for storing and distributing container images. Enables organizations to tightly control their image storage and distribution pipeline with full ownership of their distribution infrastructure. | Pulp enables developers and operators to fetch, upload, organize, and distribute software packages across on-premises infrastructure or cloud environments. It supports multiple content types through a plugin architecture and provides tools for repository management at scale. |
| features.capabilities | `{"hosting":"self","image_signing":true,"oci_compliant":true,"private_repos":true,"artifact_types":"images"}` | `{"rbac":false,"web_ui":true,"hosting":"both","sbom_support":false,"image_signing":false,"oci_compliant":true,"private_repos":true,"artifact_types":"universal","cloud_iam_native":false,"pull_rate_limits":"none","high_availability":false,"pull_through_cache":false,"replication_mirroring":false,"vulnerability_scanning":false}` |
| integrations.count | - | 2 |
| integrations.list | - | `[{"name":"OpenAI API"},{"name":"GitHub"}]` |
| language.primary | Go | Python |
| license.spdx | Apache-2.0 | GPL-2.0 |
| market.availability | - | `{"hqCountry":"US","primaryMarkets":[],"availabilityScope":"global","availableCountries":[],"notAvailableCountries":[]}` |
| platform.support | - | `{"cli":true}` |
| pricing | `{"type":"open_source","sourceUrl":"https://distribution.github.io/distribution/","retrievedAt":"2026-08-13T18:17:59.377Z"}` | `{"type":"open_source","freeTier":true,"sourceUrl":"https://pulpproject.org","retrievedAt":"2026-08-16T21:32:46.974Z"}` |
| pricing.free_tier | - | yes |
| pricing.model | open_source | open_source |
| pricing.price_level | free | free |
| pricing.transparent | - | yes |
| release.cadence_days | 55 | - |
| release.history | `[{"url":"https://github.com/distribution/distribution/releases/tag/v3.1.1","date":"2026-05-01T15:51:50Z","type":"stable","version":"v3.1.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.1.0","date":"2026-04-06T17:09:31Z","type":"stable","version":"v3.1.0"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0","date":"2025-04-03T06:25:36Z","type":"stable","version":"v3.0.0"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-rc.4","date":"2025-03-22T14:59:29Z","type":"prerelease","version":"v3.0.0-rc.4"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-rc.3","date":"2025-02-11T16:21:07Z","type":"prerelease","version":"v3.0.0-rc.3"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-rc.2","date":"2024-12-18T15:23:19Z","type":"prerelease","version":"v3.0.0-rc.2"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-rc.1","date":"2024-11-07T21:04:41Z","type":"prerelease","version":"v3.0.0-rc.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-beta.1","date":"2024-07-10T13:22:40Z","type":"prerelease","version":"v3.0.0-beta.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v3.0.0-alpha.1","date":"2023-12-19T16:03:36Z","type":"prerelease","version":"v3.0.0-alpha.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.3","date":"2023-10-02T18:23:54Z","type":"stable","version":"v2.8.3"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.2","date":"2023-05-11T10:47:43Z","type":"stable","version":"v2.8.2"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.2-beta.2","date":"2023-05-09T23:32:56Z","type":"prerelease","version":"v2.8.2-beta.2"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.2-beta.1","date":"2023-05-09T22:42:12Z","type":"prerelease","version":"v2.8.2-beta.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.1","date":"2022-03-08T18:19:10Z","type":"stable","version":"v2.8.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.0","date":"2022-02-07T15:53:07Z","type":"stable","version":"v2.8.0"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.8.0-beta.1","date":"2022-01-21T16:49:13Z","type":"prerelease","version":"v2.8.0-beta.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.7.1","date":"2019-01-17T23:22:32Z","type":"stable","version":"v2.7.1"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.7.0","date":"2018-12-04T00:20:01Z","type":"stable","version":"v2.7.0"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.7.0-rc.0","date":"2018-09-28T23:23:36Z","type":"prerelease","version":"v2.7.0-rc.0"},{"url":"https://github.com/distribution/distribution/releases/tag/v2.6.2","date":"2017-07-20T21:20:00Z","type":"stable","version":"v2.6.2"}]` | `[{"url":"https://github.com/pulp/pulpcore/releases/tag/3.116.0","date":"2026-08-12T18:28:59Z","type":"stable","version":"3.116.0"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.105.16","date":"2026-08-12T16:55:30Z","type":"stable","version":"3.105.16"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.85.28","date":"2026-07-29T15:10:38Z","type":"stable","version":"3.85.28"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.63.45","date":"2026-07-29T15:11:51Z","type":"stable","version":"3.63.45"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.49.68","date":"2026-07-29T15:11:41Z","type":"stable","version":"3.49.68"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.115.3","date":"2026-07-28T20:41:04Z","type":"stable","version":"3.115.3"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.105.15","date":"2026-07-28T20:40:51Z","type":"stable","version":"3.105.15"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.105.14","date":"2026-07-28T08:02:29Z","type":"stable","version":"3.105.14"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.85.27","date":"2026-07-28T20:40:30Z","type":"stable","version":"3.85.27"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.73.41","date":"2026-07-28T20:40:26Z","type":"stable","version":"3.73.41"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.63.44","date":"2026-07-28T20:39:47Z","type":"stable","version":"3.63.44"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.49.67","date":"2026-07-28T20:39:20Z","type":"stable","version":"3.49.67"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.105.13","date":"2026-07-27T14:15:34Z","type":"stable","version":"3.105.13"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.115.2","date":"2026-07-22T12:50:08Z","type":"stable","version":"3.115.2"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.115.1","date":"2026-07-21T17:06:56Z","type":"stable","version":"3.115.1"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.115.0","date":"2026-07-21T15:16:40Z","type":"stable","version":"3.115.0"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.114.2","date":"2026-07-20T17:19:08Z","type":"stable","version":"3.114.2"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.105.12","date":"2026-07-20T17:20:16Z","type":"stable","version":"3.105.12"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.85.26","date":"2026-07-20T17:20:28Z","type":"stable","version":"3.85.26"},{"url":"https://github.com/pulp/pulpcore/releases/tag/3.73.40","date":"2026-07-20T17:21:51Z","type":"stable","version":"3.73.40"}]` |
| reliability.status_page | yes | - |
| security.gdpr | - | yes |
| security.scorecard | 7.9 | - |
| security.vulnerabilities | `{"count":4,"source":"https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=go&package_name=github.com%2Fdistribution%2Fdistribution%2Fv3&per_page=100","last_12m":3,"max_severity":"HIGH"}` | `{"count":2,"source":"https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=pypi&package_name=pulpcore&per_page=100","last_12m":0,"max_severity":"HIGH"}` |

## Capabilities (Container Registries)

| Capability | CNCF Distribution | Pulp |
|---|:--:|:--:|
| **Deployment** |  |  |
| Hosting | Self-hosted only | Cloud + self-hosted |
| **Standards** |  |  |
| OCI Distribution Spec compliant | ✓ | ✓ |
| **Scope** |  |  |
| Artifact types | Container images only | Universal (images + language packages) |
| **Security** |  |  |
| Built-in vulnerability scanning | - | ✗ |
| Image signing (Cosign/Notation) | ✓ | ✗ |
| SBOM generation / storage | - | ✗ |
| **Access** |  |  |
| Fine-grained RBAC / robot accounts | - | ✗ |
| Private repositories | ✓ | ✓ |
| **Distribution** |  |  |
| Geo-replication / mirroring | - | ✗ |
| Pull-through cache / proxy | - | ✗ |
| **Integration** |  |  |
| Native cloud IAM integration | - | ✗ |
| **Pricing** |  |  |
| Pull-rate limits | - | None |
| **UX** |  |  |
| Web UI / console | - | ✓ |
| **Ops** |  |  |
| High-availability deployment | - | ✗ |

*Source: Vioscale. Generated 2026-09-01T16:05:26.000Z. "-" = undocumented, not absent.*