compare
Harbor vs zot
The same facts for both, read from GitHub every night, and the relation a person reviewed.
| Fact | Harbor | zot |
|---|---|---|
| Language | Go | Go |
| Licence | Apache-2.0 | Apache-2.0 |
| Stars | 30k | 2.8k |
| Latest | v2.15.3 | v2.1.21 |
| Last push | 2026-10-06 | 2026-10-06 |
| Release cadence | about 1 day between releases | about 35 days between releases |
| Active contributors | 32 commit authors on the default branch in the last 90 days | 31 commit authors on the default branch in the last 90 days |
| Flags | none | none |
How they relate
Both replace Distribution. Alternatives to Distribution →
Full replacementHarborBuilt on Distribution, with a web UI, users and policies on top.
Full replacementzotOCI distribution spec, with storage deduplication and sync from other registries.
Both replace Docker Hub. Alternatives to Docker Hub →
Full replacementHarborProjects, access control, vulnerability scanning, signing and replication between registries.
PartialzotAn OCI-native registry in a single binary, with a web UI and scanning as extensions.
Harbor
- v2.14.52026-10-06[CHERRY-PICK] Make openapi-generator-cli download URL configurable (#23186)
- v2.13.62026-10-06fix: pin redis 7.2.11 instead of 7.2.6 in the redis base image
- v2.15.32026-10-06(high): Path traversal vulnerability in distribution endpoints GHSA-qj39-pjf2-wmrc in a82c5528f
- v2.15.3-rc22026-09-24(cherry-pick) fix: avoid panic in user audit event resolver on nil event data (#23461)pre-release
- v2.15.3-rc12026-09-11(cherry-pick) fix: avoid panic in user audit event resolver on nil event data (#23461)pre-release
zot
- v2.1.212026-09-06fix(ci): use latest zot for upgrade tests
- v2.1.202026-08-04chore: bump zui version
- v2.1.192026-08-04fix(api): align blob, manifest, and referrers handling with OCI conformance
- v2.1.182026-06-24chore: fix dependabot alerts
- v2.1.172026-05-18fix(api): return 416 for bad upload range on PUT; fix GET upload Range at size zero
Harbor
unsigned The latest release, v2.15.3, carries no signature GitHub could verify.
Loading the security report
zot
✓ signed The latest release, v2.1.21, carries a signature GitHub verified.
Loading the security report