文章
NebulaCR：具备可观测性与合规能力的企业级 OCI 镜像仓库
Rust 镜像仓库栈、零信任 OIDC、SCIM、Prometheus 指标与 Kubernetes 原生 Helm 部署
本页内容
NebulaCR（github.com/bwalia/nebulacr）是 Rust Cargo workspace：nebula-registry（OCI API，:5000）、nebula-auth（OIDC + JWT，:5001）、nebula-common、nebula-controller（CRD）、nebula-mirror（pull-through）、nebula-resilience 与 nebula-replication。构建：cargo build --workspace --release。官网：nebulacr.org。完整文章：文档博客。
示意图（来自 README / Cargo 布局）
要点
- OCI Distribution API v2，兼容 Docker 与 Podman
- 面向 CI（GitHub Actions、GitLab）与交互式 SSO 的零信任 OIDC
- Prometheus 指标（如 nebulacr_http_requests_total）、结构化日志、OpenTelemetry 追踪
- 面向 Docker Hub、GHCR、GCR、Quay、registry.k8s.io 的 pull-through 缓存
- Helm OCI chart（ghcr.io/bwalia/charts）、HPA、ingress TLS、ServiceMonitor
更多技术文章
Big Prometheus at Scale: Pros, Cons, and a MoSCoW Map of Observability Tools
TenthMatrix rewrite of the Big Prometheus problem space: Thanos, Cortex/Mimir, VictoriaMetrics, M3/Chronosphere — plus MoSCoW across OTEL, Grafana, SaaS APM and more
WSL Vault Technical Deep Dive: Zero-Trust Secrets, Dual Control, MFA & Multi-Region HA
Technical deep dive: envelope hierarchy, dual-control workflows, MFA, leases, active/active multi-region HA, feature tours, and presentation chapters
Workstation AI Shop on Ring Promoter: Orbit, Version-Verified Health and the Path from INT to PROD
Technical guide: shop Helm/CI mapping, Orbit semantics, version-verified health for the AI agent, secrets per ring, promote API, and a production checklist