Roadmap

What roci does today, what is being built, and what comes next.

31Shipped

5In progress

17Planned

1Blocked

Being built now

• Single binaryCore distribution
• Core / extension splitCore distribution
• HTTP/2 and TLS 1.3Core distribution
• SHA-512 digestsCore distribution
• Boundary hardeningSecurity & access control

Core distribution

7/14

The OCI Distribution Spec, served from a plain OCI image layout.

• OCI Distribution Spec v1.1.1

  Passes the upstream conformance suite.

• OCI image layout storage

  Any layout on disk can be served as a registry.

• Rootless

  Runs without root privileges.

• Config-driven

  Behavior controlled entirely via configuration.

• Multi-platform releases

  Binaries for multiple operating systems and architectures.

• Delete by tag
• On-premises ready

  e.g. colocated with Kubernetes.

• Single binaryIn progress

  One binary for all features.

• Core / extension splitIn progress

  Dist-spec core cleanly separated from roci extensions.

• HTTP/2 and TLS 1.3In progress

  Multiplexing and keep-alive; optional kTLS zero-copy.

• SHA-512 digestsIn progress

  SHA-512 by default, SHA-256 accepted; constant-time verification.

• Ecosystem compatibilityPlanned

  skopeo, cri-o.

• Digest response cachingPlanned

  ETag / If-None-Match → 304; correct tag-vs-digest cache-control.

• Foreign media typesPlanned

  Nydus, eStargz, SBOMs, signatures and tar+zstd layers served as opaque blobs.

Security & access control

9/11

Authenticated, authorized, and hard to misuse.

• TLS 1.3

  0-RTT hardening via 425 Too Early.

• Mutual TLS

  Client certificates with optional CA or leaf-fingerprint pinning.

• Basic auth — htpasswd

  bcrypt only.

• Basic auth — LDAP

  Opt-in cargo feature ldap, not in full.

• Bearer tokens

  External token server; ES256/RS256, per-request scope binding.

• Identity-based access control

  Glob patterns, specificity matching, admins and groups.

• Live authorization reload

  Change access rules without a restart.

• Repository isolation

  No cross-repo presence oracle; cross-repo mounts authorized twice.

• SSRF containment

  No client-supplied URL fetches; allowlisted, repo-gated redirects.

• Boundary hardeningIn progress

  Path-traversal-safe validation, digest allowlist, bounded inputs.

• CVE-class regression suitePlanned

  Prior-art registry CVEs replayed in CI.

Storage

8/8

Content-addressed, deduplicated, self-healing.

• Online garbage collection

  O(garbage) with a grace period and backref index; never offline.

• Copy-on-write dedup

  Reflink (FICLONE) across repos, with hard-link and copy fallbacks.

• Data scrubbing

  CRC32C checks, digest re-hash on mismatch, quarantine.

• Multiple storage paths

  Mix local paths and S3-compatible object storage in one server.

• Quotas

  Per-repo and total quotas, plus a cap on concurrent uploads.

• Small-blob cache

  Byte-capped in-memory LRU for manifests and configs.

• Metadata engines

  In-memory log (default, optional HMAC) or LMDB on disk.

• Lossless engine switching

  log ↔ lmdb with a verified migration at startup.

Operability

7/10

Observable, deployable, boring to run.

• Rate limiting

  Per HTTP method and per client.

• Prometheus metrics
• OpenTelemetry

  OTLP traces, metrics and logs.

• Fast cold start

  Opt-in fast_restart stamp and a low-fragmentation allocator.

• Hardened Helm chart

  PSS restricted, NetworkPolicies, optional HA S3 on RustFS; attested OCI artifact at oci://ghcr.io/jakobmoellerdev/charts/roci.

• Health endpoints

  /readyz and /livez, unauthenticated and rate-limit-free.

• S3 bucket auto-creation

  create_bucket, plus private-CA trust via ca_file.

• Node exporter for minimal buildsPlanned
• OpenAPI documentationPlanned
• RustFS client-cert mTLSBlocked

  object_store has no client-cert API; the RustFS chart has no server-TLS-only mode.

Content & ecosystem

0/5

Signatures, charts and lazy pulls.

• cosign signaturesPlanned
• notation signaturesPlanned
• Helm charts as artifactsPlanned
• Lazy-pull originPlanned

  eStargz, SOCI and Nydus via Range requests and referrer metadata.

• BLAKE3 verified streamingPlanned

  Per-Range-chunk integrity, stored as a referrer.

Query & search

0/2

Find images and what is inside them.

• Search extensionPlanned

  Advanced image queries.

• Vulnerability scanningPlanned

  Trivy, with SPDX/CycloneDX SBOMs as referrers.

Scaling

0/3

From a Raspberry Pi to a cluster.

• Vertical scalePlanned

  Streaming, zero-copy, bounded memory on one node.

• Horizontal scale-outPlanned

  Repo sharding via consistent hashing with a peer proxy.

• Memory follows referencesPlanned

  RSS scales with reference count, not stored bytes.

Replication

0/1

Mirror other registries.

• Registry syncPlanned

  Pull and synchronize from any dist-spec conformant registry.