Projects sharing features with Go Containerregistry

This project is a Docker educational resource and a collection of practical examples designed for learning containerization technologies. It serves as a guide for understanding container fundamentals, including the creation and management of custom images and the use of registries. The repository provides specialized references for container security hardening, such as managing kernel privileges and implementing supply chain security. It also includes tutorials for multi-container orchestration and a DevOps guide focused on CI/CD automation and image optimization. The material covers a broad

img is a daemon-less tool for building Open Container Initiative compliant images without requiring root privileges. It functions as a standalone builder and registry client that creates container images from build files without the need for a background process or elevated system permissions. The project provides a multi-platform image generator capable of targeting different operating systems and hardware architectures. It includes an OCI registry client for authenticating with remote registries to push, pull, and manage image artifacts. The toolset covers image construction and artifact m

This project is a GitHub Action that automates the building and pushing of Docker container images to OCI registries. It functions as a multi-platform container builder and publisher using the Buildx engine to create images compatible with multiple hardware architectures. The tool distinguishes itself through software supply chain security features, including the generation of software bills of materials and provenance attestations to verify image integrity. It optimizes construction speed via remote cache management and supports secure secret injection to prevent sensitive data from persisti

Ko is a daemonless container image builder and OCI image generator specifically for Go applications. It compiles Go source code into binaries and packages them directly into container images, pushing them to registries without requiring a local container runtime or daemon. The tool specializes in multi-platform image distribution, producing images for various CPU architectures and operating systems from a single execution. It distinguishes itself by automating the entire pipeline from Go import paths to Kubernetes deployment or serverless function packaging for architectures like AWS Lambda.

This project provides a collection of official base images for building and running .NET applications across various operating systems and hardware architectures. It includes standardized runtime environments, containerized development kits, and specialized images designed for isolated application execution. The collection is distinguished by its focus on image optimization and security hardening. It offers distroless images that remove shells and package managers to reduce the attack surface, as well as composite layering and ahead-of-time compilation to improve startup performance and lower

This project is a collection of curated and standardized Docker base images that serve as reliable starting points for building containerized applications. It functions as an OCI container image repository and a build template library, providing a central source of truth for images that adhere to Open Container Initiative standards for portability. The project utilizes an automated image lifecycle pipeline to build, tag, and push images, ensuring that dependencies remain current and security patches are applied. It specifically supports cross-platform distribution by providing a multi-archite

This project provides a comprehensive architectural blueprint and implementation set for building a platform-as-a-service on Kubernetes. It serves as a technical resource for deploying container orchestration environments, managing the full software development lifecycle, and integrating a complete DevOps toolchain. The implementation emphasizes automated software delivery through the integration of build and delivery pipelines, private container registries, and distributed configuration systems. It enables the decoupling of application settings from images via a centralized configuration man

This project provides a comprehensive guide and set of scripts for deploying and configuring a production-ready Kubernetes cluster from scratch. It centers on establishing a functional environment by installing core management components, storage, and networking across multiple nodes. The implementation emphasizes high availability for the control plane, utilizing layer-4 load balancing and leader election for the API server, scheduler, and controller manager. It further ensures reliability through the deployment of a distributed key-value store for persistent runtime data. The project cover

Skopeo is an OCI container image manager and registry client designed for inspecting, copying, and signing container images across different registries and storage backends. It enables the manipulation of container images using direct API calls to registries, operating independently of a local container daemon or runtime. The tool provides specialized capabilities for container image mirroring and synchronization, specifically supporting the mirroring of external repositories to internal registries for air-gapped environments. It also functions as a container image signing tool, allowing for

Kaniko is an OCI container image builder that executes Dockerfiles in userspace without requiring a privileged daemon. It is designed as a Kubernetes-native image builder, allowing for the construction and pushing of images to registries from within a cluster or container. The tool ensures reproducible build generation by stripping timestamps from image layers, guaranteeing that identical source inputs produce the same image identifier. It supports multi-architecture image building, allowing for the creation of images compatible with various hardware and operating systems from a single proces

Inspektor Gadget is an eBPF observability toolset and program framework designed for tracing Linux systems and debugging Kubernetes nodes. It provides a suite of tools to collect kernel-level telemetry and export system metrics via the OpenTelemetry standard. The project distinguishes itself by packaging inspection tools as OCI-compliant container images, allowing for standardized distribution and deployment across clusters and hosts. It employs a modular data processing pipeline that utilizes WebAssembly modules to transform and filter telemetry, and leverages Compile Once Run Everywhere for

ZenML is an extensible machine learning orchestration framework designed to manage the end-to-end lifecycle of data pipelines and AI agent workflows. It functions as a durable orchestrator that executes machine learning tasks as directed acyclic graphs, ensuring that every step is containerized for consistent performance across local, cloud, and hybrid infrastructure. By decoupling pipeline code from underlying compute and storage backends, the platform allows developers to define infrastructure-agnostic stacks that remain portable across diverse environments. The project distinguishes itself

Serverless Registry is a container registry service implemented as a serverless application. It provides a platform for hosting and managing container images by leveraging distributed object storage and edge computing to handle image layers and metadata. The project distinguishes itself by utilizing edge-side request proxying and lazy pull-through caching to manage external image dependencies. By fetching and persisting remote images on demand, it improves availability and access speeds for container runtimes. The system also employs chunked stream processing to manage large image layers, ens

Harbor is a self-hosted, enterprise-grade container registry platform designed to store, sign, and scan container images and cloud-native artifacts. It provides a centralized repository that integrates directly with Kubernetes environments to manage the full lifecycle of software artifacts, from initial storage to production deployment. The platform distinguishes itself through a focus on security, governance, and multi-site availability. It features a pluggable vulnerability scanning framework that allows for the integration of various security engines, alongside content trust mechanisms tha

The OCI Container Image Specification is a standardized format for container images that ensures interoperability between different build tools and runtimes. It serves as a distribution standard for structuring image blobs and manifests, providing a consistent way to transfer data between registries and clients. The specification employs a content-addressable storage standard that identifies image layers and manifests using cryptographic digests to ensure data integrity. It includes a JSON-based configuration schema for defining execution metadata, such as entrypoints and environment variable

Public Image Mirror is a container registry proxy service designed to cache remote container images locally. By intercepting image pull requests and serving content from internal storage, it reduces dependency on external registry availability and minimizes external bandwidth consumption. The service implements standard container registry protocols, allowing existing container runtimes to interact with the cache as if it were a native registry. It utilizes a content-addressable storage layer to manage image layers as immutable blobs, ensuring data integrity and deduplication while resolving m

Buildah is a tool for creating OCI-compliant container images without requiring a background daemon process. It functions as a daemonless image constructor and distribution tool, allowing users to build, push, and pull images between local storage and remote registries. The project distinguishes itself by supporting unprivileged image building through the use of user namespaces and rootless mode. It enables direct modification of container root filesystems by mounting them to the host, allowing images to be treated as directories that can be manipulated via standard shell commands or scripts.

Docker is an OCI container engine and runtime orchestrator used to build, run, and manage isolated applications. It functions as a container image builder for creating portable snapshots of applications and a registry manager for storing, versioning, and distributing those images across environments. The platform provides a centralized daemon to control the creation, execution, and termination of containerized workloads. It allows for the assembly of modular container systems by combining build tools, registries, and runtimes. Its core capabilities cover container image creation, registry ad

Noms is a distributed version control database and content-addressable data store. It identifies data by cryptographic hashes to ensure integrity and deduplication, while tracking dataset state changes through a sequence of immutable commits to enable branching, forking, and historical recovery. The system functions as a peer-to-peer data synchronizer, reconciling state between disconnected database instances to ensure all nodes converge on the same data. It distinguishes itself as a schema-flexible document store that supports self-describing types, allowing schemas to evolve and widen as ne

Buildx is a BuildKit build extension and container build instance manager that enables the creation of container images targeting multiple CPU architectures and operating systems simultaneously. It functions as a multi-platform image builder that leverages a BuildKit backend to extend standard image building capabilities. The project features a distributed build orchestrator capable of coordinating tasks across a cluster of remote nodes. This allows for native compilation across different hardware architectures by connecting multiple remote workers into a single instance to increase build con

Tart is an Apple Silicon virtualization manager used to build and run macOS and Linux virtual machines using native hardware virtualization frameworks. It functions as a virtual machine cluster orchestrator and an ephemeral runner for executing continuous integration pipeline steps within isolated, short-lived environments. The system utilizes an OCI-compatible virtual machine registry to push and pull images via standardized container registries. It features a controller-worker architecture that schedules virtual machine lifecycles across remote worker nodes, incorporating a secure SSH jump

This project provides strategic roadmaps and guides detailing the evolution and deployment patterns of managed container orchestration and security services. It serves as a public tracking document for upcoming features and development priorities for EKS, ECS, ECR, and Fargate. The resource includes a cloud container orchestration guide and a Kubernetes and ECS strategy, outlining the development of managed Kubernetes and proprietary orchestration services for cloud infrastructure. It also provides a security and monitoring plan focused on scanning malicious activity and tracking workload hea

SD Maid SE is an Android storage optimization and system maintenance utility. It focuses on reclaiming disk space by analyzing storage usage and removing duplicate, orphaned, or unused files. The project distinguishes itself through the use of accessibility services to automate repetitive device tasks and manual file reviews by simulating user interactions. It also includes specialized tools for reducing the file size of images and videos through media compression. The system provides a broad range of capabilities including application lifecycle management to freeze or remove software, junk

Syft is a software bill of materials generator, container image scanner, and software dependency catalog. It analyzes container images and filesystems to produce comprehensive inventories of installed packages and dependencies in standard formats. Additionally, it serves as a software attestation tool and an SBOM format converter. The project distinguishes itself through the ability to create cryptographically signed attestations for software inventories to ensure provenance and integrity. It also provides the capability to transform software bills of materials between different industry sche

Ramalama is a containerized runtime and management tool for large language models. It functions as an OCI AI model manager and registry client, allowing users to package, distribute, and execute AI models as standardized container images. The project differentiates itself by using OCI-compliant distribution for models and retrieval augmented generation assets, enabling the packaging of vector databases into immutable container images. It features hardware-aware image selection that automatically detects GPU or CPU capabilities to pull the most optimized image for the host environment. The sy

This project serves as a documentation hub and specification repository for official Docker images. It functions as a metadata-driven documentation generator that transforms structured content files into markdown files and readmes for public distribution. The repository provides technical guides and configuration standards for deploying containerized software across multiple CPU architectures. It includes detailed manuals for configuring environment variables, volume mounts, and network settings to ensure consistent image deployments. The documentation covers a broad range of containerized e

This project is a container image transfer library and programmatic toolkit designed for moving and managing container images between distinct registries, storage backends, and file formats. It provides an OCI image specification toolkit for inspecting, parsing, and converting image formats across different registry implementations without format loss, acting as a registry client library for interacting with remote endpoints to pull, push, and inspect manifests. The library features a transport-plugin architecture that uses modular communication handlers to connect remote registries, local st