Angos
Angos is an open-source OCI registry configured in one file and operated without a database or lock service.
What Angos is
Angos is an open-source OCI registry configured in one file and operated without a database or lock service. Its web interface lets users inspect repositories, manifests, referrers, pull history, and image filesystems layer by layer. The registry supports OCI 1.1 and works with Docker, Podman, containerd, and other OCI tools. It can cache Docker Hub, ghcr.io, or another upstream registry, then replicate repositories to downstream registries in both directions through a durable retry queue. CEL policies and optional webhooks control push, pull, and delete access by repository. Passwordless CI authentication uses OIDC from GitHub Actions, Kubernetes, or another issuer. Trivy or Grype scans can run on push, storing reports as OCI referrers. Filesystem and S3-compatible storage are supported independently for blobs and metadata. Retention rules and immutable tags help manage releases. Angos lists Linux and macOS binaries, Apache-2.0 licensing, TLS, mutual TLS, rate limiting, and fail-closed authorization.
Good
- No database or lock service required
- OCI 1.1 and major container-tool compatibility
- Repository-level CEL access policies
- OIDC authentication for CI systems
- Retention rules and immutable tags
Watch out
- Filesystem storage is single-instance by default
- Multiple instances recommend shared S3 storage
- Self-hosted operation is required
Who it suits
Angos suits teams operating container registries that want OCI compatibility, repository policies, caching, replication, and image scanning. It supports self-hosted deployments on Linux, macOS, or shared S3 storage.
Verdict
Angos combines registry storage, inspection, replication, access control, and scanning without a database dependency. Its storage and deployment requirements matter most when scaling beyond one instance.
The facts
Each one read from Angos's own pages, with the date it was checked.
What it does
- Access control
- CEL policies and optional webhooks control push, pull, and delete access per repository.checked 11 Oct 2026
- Artifact verification
- The release page says artifacts are signed with keyless Sigstore Cosign using GitHub Actions OIDC, with verification backed by the public Sigstore transparency log.checked 11 Oct 2026
- Caching
- It can mirror Docker Hub, ghcr.io, or another upstream registry through a pull-through cache.checked 11 Oct 2026
- CI authentication
- Passwordless CI authentication supports OIDC from GitHub Actions, Kubernetes, or another issuer.checked 11 Oct 2026
- Downloads
- The v1.12.2 release lists standalone binaries for Linux amd64 and arm64, and macOS Intel and Apple silicon.checked 11 Oct 2026
- Image inspection
- Its web UI browses repositories, manifests, referrers, pull history, and image filesystems layer by layer.checked 11 Oct 2026
- Integrations
- The project README lists Docker Compose and Kubernetes deployment guides, GitHub Actions OIDC setup, and Trivy or Grype scanning.checked 11 Oct 2026
- License
- The project’s GitHub repository identifies its license as Apache-2.0.checked 11 Oct 2026
- OCI compatibility
- Angos supports Docker, Podman, containerd, and other OCI tools, including OCI referrers for signatures and SBOMs.checked 11 Oct 2026
- Operations
- Angos requires no database or lock service, supports replicas sharing storage, and runs garbage collection, scrub, and prune while serving.checked 11 Oct 2026
- Product
- Angos is an OCI registry configured in one file and run without a database.checked 11 Oct 2026
- Registry compatibility
- Angos supports OCI 1.1 and works with Docker, Podman, containerd, and other OCI tools.checked 11 Oct 2026
- Release verification
- The v1.12.2 release says artifacts are signed with keyless Sigstore Cosign using GitHub Actions OIDC.checked 11 Oct 2026
- Replication
- It mirrors repositories to downstream registries in both directions with a durable retry queue.checked 11 Oct 2026
- Retention
- Retention rules can keep tags by age, semantic-version pattern, or recent pushes and pulls; immutable tags can protect releases from overwrites.checked 11 Oct 2026
- Scaling
- For multiple registry instances, the storage documentation recommends shared S3 storage; filesystem storage is single-instance unless shared storage is used.checked 11 Oct 2026
- Scanning
- Trivy or Grype can scan images on push, with reports stored beside the image as OCI referrers.checked 11 Oct 2026
- Security
- The security model documents TLS, authentication, rate limiting, and fail-closed authorization behavior for critical security decisions.checked 11 Oct 2026
- Security features
- Angos supports mutual TLS and can run Trivy or Grype vulnerability scans on push, keeping reports beside images as OCI referrers.checked 11 Oct 2026
- Storage
- The project README says Angos stores its data in the image storage, which can be a directory or an S3 bucket.checked 11 Oct 2026
- Supported downloads
- The release page lists standalone binaries for macOS amd64 and arm64 and Linux amd64 and arm64.checked 11 Oct 2026
The company
- Maker details
- The site footer credits “Angos Maintainers”; the pages opened did not state a headquarters or founding year.checked 11 Oct 2026
Alternatives to Angos
- 1
JFrog Container Registry
Free planWebAPILinuxSelf-hosted7.6Free plan - 2
Inedo ProGet
Free planWebAPILinuxSelf-hosted7.4From $2,395 a year - 3
Alibaba Cloud Container Registry
Free planWebAPILinuxWindows7.1Free plan - 4
Oracle Cloud Infrastructure Container Registry
Free planWebAPILinux7.0Free plan - 5
Samsung Cloud Platform Container Registry
AndroidiOSWebAPI7.0 - 6
Chainguard Registry
Free planWebLinuxSelf-hosted6.8Free plan