// the find
Trow-Registry/trow
Container Registry and Image Management for Kubernetes Clusters
Trow is a small Rust-based container registry meant to run inside a Kubernetes cluster, mainly to cache pulled images and gate which ones are allowed to run via an admission webhook. It's aimed at platform/infra engineers who want a lightweight in-cluster registry-cache rather than standing up something like Harbor.
It runs OCI distribution spec conformance tests (run_oci_conformance_tests.sh) rather than just claiming compatibility. The admission webhook for approve/deny image lists solves a real supply-chain problem directly in the registry instead of bolting it on separately. It uses sqlx with compile-time checked queries and versioned SQL migrations, which is a sign of actual engineering discipline rather than a toy project. A Helm chart is provided, so trying it in a real cluster isn't a DIY packaging exercise.
The README is upfront that this is beta with rough edges, and the architecture is single-instance only — HA/distributed support is listed as 'coming soon', so it's a single point of failure if you depend on it for every image pull in the cluster. Auth and auditing of image access are marked 'planned', not implemented, so the access-control story beyond the admission webhook is incomplete. The user guide only covers persisting images and listing tags via curl — there's no operational runbook for running this as critical infrastructure. At ~1k stars against entrenched alternatives like Harbor or zot, the community and battle-testing are thin for something sitting in the image pull path of production clusters.