zot OCI Registry On Loopback, Config Checked, A Blob Round-Tripped

zot

zot, the OCI-native registry, from the upstream release binary (sha256-verified), as a hardened system service on loopback with local storage, deduplication and garbage collection on, for a TLS proxy that authenticates. Original role for EL 10, live-tested with podman on Rocky Linux 10.

No package, so the checksum is the whole story. EL 10 carries no zot; zot ships a release with a checksum file beside it. The role downloads both and has Ansible's get_url refuse the binary unless its SHA-256 is the one in the vendor's file, then installs it as root's in /usr/local/bin, pinned by zot_version.

A service account, a hardened unit, a loopback listener. zot is a system user with no shell that owns the data directory and nothing else; the unit runs with NoNewPrivileges, PrivateTmp, ProtectHome and ProtectSystem=strict. The listener is 127.0.0.1:5000 by default, for a proxy that authenticates or a client on the same host; the live test reads the listening sockets and expects loopback only.

Checked by the release that reads it. zot verify checks config.json before it lands (an unknown key is refused: "invalid keys"). The minimal build is the default: the registry and nothing else; zot_minimal: false installs the full build whose UI and search extensions you then enable in zot_extra_config.

Proven by a blob. The live test walks the OCI distribution protocol: starts an upload, puts a blob by digest, reads its headers back, sees the repository in _catalog, and deletes the blob. The checksum file lists its names with a leading * (binary mode), which Ansible's get_url matches. This catalogue's registry role (CNCF Distribution) is the alternative on the same port; one host runs one of the two.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.