Run a private container registry with zot

# Introduction I wrote a few small programs for my home, mostly Prometheus exporters for IoT devices. They run in containers, and until recently I had to build their images on my laptop and push them to the server. This worked, but there was no test before deploying, and I was not updating the base image which is a security issue. Now, the images are built on the CI of my Forgejo server, and pushed to a container registry in my network, then the servers pull them automatically when there is a new version. This article is the first of a series of four about this setup: * a private container registry with zot (this article) * building container images with a Forgejo runner and Docker-in-Docker * keeping the dependencies up to date with Renovate * verifying the base images with cosign and hardening the images The registry I use is zot, while I use "registry" (the reference registry from the Distribution project) as a pull-through cache. Zot provides authentication and access control per…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town