bwalia/nebulacr repository overview

⁠NebulaCR

A cloud-native Docker/OCI container registry built in Rust with multi-tenancy, zero-trust authentication, and pull-through caching.

⁠Quick Start

docker run -d -p 5000:5000 bwalia/nebulacr:latest

Then push an image:

docker tag nginx:latest localhost:5000/myorg/nginx:latest
docker push localhost:5000/myorg/nginx:latest

⁠Key Features

• OCI Distribution API v2 compliant
• Pull-through cache for Docker Hub, GHCR, GCR, Quay.io, registry.k8s.io
• Multi-tenancy with Tenant, Project, and AccessPolicy CRDs
• Zero-trust auth via OIDC (Google, GitHub Actions, GitLab CI, Azure AD)
• Multiple storage backends -- filesystem, S3, GCS, Azure Blob
• High availability -- stateless services, HPA, circuit breakers
• Multi-region replication with async/semi-sync modes
• Observability -- Prometheus metrics, JSON logging, OpenTelemetry tracing
• Multi-architecture -- linux/amd64 and linux/arm64

⁠Image Tags

⁠Docker Compose

services:
  registry:
    image: bwalia/nebulacr:latest
    command: ["nebula-registry"]
    ports:
      - "5000:5000"
      - "9090:9090"
    environment:
      NEBULACR_STORAGE__BACKEND: filesystem
      NEBULACR_STORAGE__ROOT: /var/lib/nebulacr/data
      NEBULACR_AUTH__VERIFICATION_KEY_PATH: /etc/nebulacr/keys/public.pem
    volumes:
      - registry-data:/var/lib/nebulacr/data

See the full docker-compose.yml⁠ for a complete setup with auth and key generation.

⁠Kubernetes (Helm)

helm install nebulacr oci://ghcr.io/bwalia/charts/nebulacr \
  --namespace nebulacr --create-namespace

⁠Ports

⁠Environment Variables

⁠Links

• GitHub Repository⁠
• Documentation⁠
• Helm Chart⁠

⁠License

Apache-2.0