Article
NebulaCR: Enterprise OCI Registry With Observability and Compliance
Rust registry stack, zero-trust OIDC, SCIM, Prometheus metrics, and Kubernetes-native Helm deployment
On this page
NebulaCR (github.com/bwalia/nebulacr) is a Rust Cargo workspace: nebula-registry (OCI API, :5000), nebula-auth (OIDC + JWT, :5001), nebula-common, nebula-controller (CRDs), nebula-mirror (pull-through), nebula-resilience, and nebula-replication. Build with cargo build --workspace --release. Official site: nebulacr.org. Full write-up: documentation blog.
Diagrams (from README / Cargo layout)
Highlights
- OCI Distribution API v2, Docker and Podman compatible
- Zero-trust OIDC for CI (GitHub Actions, GitLab) and interactive SSO
- Prometheus metrics (e.g. nebulacr_http_requests_total), structured logs, OpenTelemetry tracing
- Pull-through cache for Docker Hub, GHCR, GCR, Quay, registry.k8s.io
- Helm OCI chart (ghcr.io/bwalia/charts), HPA, ingress TLS, ServiceMonitor
More technical articles
Big Prometheus at Scale: Pros, Cons, and a MoSCoW Map of Observability Tools
TenthMatrix rewrite of the Big Prometheus problem space: Thanos, Cortex/Mimir, VictoriaMetrics, M3/Chronosphere — plus MoSCoW across OTEL, Grafana, SaaS APM and more
WSL Vault Technical Deep Dive: Zero-Trust Secrets, Dual Control, MFA & Multi-Region HA
Technical deep dive: envelope hierarchy, dual-control workflows, MFA, leases, active/active multi-region HA, feature tours, and presentation chapters
Workstation AI Shop on Ring Promoter: Orbit, Version-Verified Health and the Path from INT to PROD
Technical guide: shop Helm/CI mapping, Orbit semantics, version-verified health for the AI agent, secrets per ring, promote API, and a production checklist