Quay (software)

Quay (software)
Name	Quay
Developer	Red Hat
Released	2014
Latest release	(see vendor)
Operating system	Linux
Programming language	Go, Python
License	Proprietary, Open source components
Website	(vendor)

Quay (software) Quay is an enterprise container registry platform for storing, building, and distributing container images, designed to operate in cloud and on-premises environments. It integrates with major orchestration and continuous delivery systems, supports image vulnerability scanning, and provides access control suitable for large organizations. The platform is maintained by Red Hat and used alongside technologies in the container and cloud native ecosystem.

Overview

Quay serves as a registry for OCI and Docker images, enabling teams using Kubernetes, OpenShift, Docker Swarm, and Amazon Web Services to push, pull, and replicate images. It offers features for image signing, automated builds, and repository mirroring that complement tools such as Docker, Podman, Helm, Terraform, and Ansible. Enterprise users combine Quay with CI/CD services like Jenkins, GitLab CI/CD, CircleCI, Travis CI, and GitHub Actions to implement continuous deployment pipelines. Organizations concerned with supply chain security pair Quay with scanners like Clair, and integrate it into policy frameworks driven by Istio, OPA (Open Policy Agent), and SPIFFE.

History and Development

Quay originated as a product by CoreOS before being acquired by Red Hat in a corporate transaction that followed consolidation trends involving CoreOS, Red Hat, and IBM. Early development targeted compatibility with the Docker Registry API used by Docker Hub and adapted to emerging standards from the OCI (Open Container Initiative). Over its lifecycle Quay has evolved through collaboration with projects such as Kubernetes, CRI-O, and containerd, and through community and enterprise feedback channels linked to organizations like Fedora Project and CentOS. Major releases added features to support integrations with identity providers including LDAP, OAuth providers such as Okta, and enterprise directories like Active Directory.

Features and Architecture

Quay’s architecture separates storage, metadata, and user interface components, leveraging object stores and databases common in enterprise stacks. It can store blobs in backends like Amazon S3, Google Cloud Storage, and OpenStack Swift while indexing metadata in databases such as PostgreSQL. The platform exposes APIs compatible with the Docker Registry HTTP API V2 used by Docker Engine and clients such as Skopeo, enabling tooling interoperability with Buildah and Podman. Key features include repository-level access controls, team and role management that integrate with LDAP and SAML identity providers; image vulnerability scanning via integrations with Clair and other scanners; image signing and verification compatible with Notary and TUF-related tooling; and automated build triggers tied to repositories hosted on GitHub, GitLab, and Bitbucket. High-availability deployments use load balancers from vendors like F5 Networks or cloud services such as AWS ELB and orchestration with Kubernetes and Red Hat OpenShift Container Platform.

Security and Compliance

Security capabilities center on vulnerability detection, image promotion workflows, and access auditing compatible with standards embraced by enterprises and regulators. Quay integrates CVE data sources used by NIST and aligns with scanning ecosystems employed by CIS benchmarks and NIST SP 800-series guidance. Role-based access control and single sign-on integrations allow compliance teams to map controls to frameworks such as SOC 2, ISO/IEC 27001, and FedRAMP requirements applicable to cloud deployments on platforms like Microsoft Azure, Google Cloud Platform, and Amazon Web Services. The registry supports image signing and provenance tracking that complements supply chain security initiatives advocated by Linux Foundation projects and government guidance from entities such as U.S. Department of Defense.

Deployment and Integration

Deployments of Quay are common in hybrid cloud, private datacenter, and public cloud environments; architects often deploy it on Red Hat OpenShift, Kubernetes Engine, or traditional virtualization stacks managed by VMware vSphere. Integration patterns include CI/CD connectors for Jenkins X, Argo CD, and Flux to enable GitOps workflows tied to container images stored in Quay. Replication and mirroring capabilities are used to synchronize registries across regions and clouds, supporting disaster recovery plans that reference mechanisms used by AWS S3 Cross-Region Replication and Google Cloud Storage replication. Monitoring and logging commonly integrate with observability stacks such as Prometheus, Grafana, ELK Stack, and Splunk for operational telemetry and audit trails.

Licensing and Editions

Quay is offered in community and enterprise forms, with open source components under licenses common to Apache Software Foundation and GNU Project ecosystems while enterprise subscriptions provide commercial support from Red Hat. Editions differ by features such as high-availability support, advanced authentication connectors, enterprise-grade support, and compliance reporting. Organizations evaluate Quay alongside alternatives such as Docker Trusted Registry, Harbor, Amazon ECR, and Google Artifact Registry when selecting a registry that fits procurement and licensing policies of institutions like NASA, European Commission, and major technology firms.

Category:Container registries Category:Red Hat software