GitLab.com container registry
- Free allowance
- No published storage cap.
- Verdict
- ★ qualifiesusable as stated; the read path was probed
- Cost
- free tier
- Identity
- anonymousno card, no phone
- Binding limit
- noneno named constraint binds
- Evidence
- reported5 sources; a third party said so
- Freshness
- stale on 2026-11-05checked 2026-10-21 (inherited); stale on 2026-11-05
| Free tier | No published storage cap. Explicitly excluded from the per-project 10 GiB limit; unlimited container repositories per project is the practical reading. unit GiB; metered on stored-bytes |
|---|---|
| Price | none stated |
| Identity | anonymous not published |
| Egress | Free, Cloudflare + Google Cloud CDN. Blob requests 307-redirect to cdn.registry.gitlab-static.net with a signed URL — directly cacheable by an external Cloudflare zone. |
| Per-object cap | not stated |
| Retention | not stated |
| Interface | oci oci |
| Tooling | Standard OCI Distribution v2. ORAS, skopeo, crane, docker. Auth flow is anonymous for public projects (/jwt/auth returns a token with auth_type=none). |
| Composes with | One OCI artifact per blob of any size -> unlimited projects x unlimited repositories x unlimited tags. This is the canonical 'OCI registry as object store' pattern (ORAS). Blob dedupe means the same chunk stored in N projects costs one copy but is addressable N times. |
| Reliability | GitLab has run garbage-collection and cleanup-policy tooling against registries since 2023; no automatic purge is documented, but stale-tag cleanup policies are a first-class feature other users may set on shared projects. Own projects are not touched. |
Evidence 5
| date | source | what it proved |
|---|---|---|
| 2026-10-21 | docs.gitlab.com/user/storage_usage_quotas/ | package/container registries excluded from the limit |
| 2026-10-21 | registry.gitlab.com/v2/ | probe: GET -> 401 with WWW-Authenticate: Bearer realm="https://gitlab.com/jwt/auth",service="container_registry"; Server: cloudflare; gitlab-sv: registry-us-east1-c |
| 2026-10-21 | gitlab.com/jwt/auth?service=container_registry&scope=reposit | probe: GET -> 200, JWT with "auth_type":"none" (anonymous pull token, no credentials) |
| 2026-10-21 | source not published | probe: GET /v2/gitlab-org/gitlab-runner/manifests/latest with that token -> 200, application/vnd.oci.image.index.v1+json, digest sha256:f1c76f915d7f70d8b3e25cac58da3d87d3d10106dda82ee780409440e1dc1ccc, Server: cloudflare |
| 2026-10-21 | cdn.registry.gitlab-static.net/ | probe: GET /v2/gitlab-org/gitlab-runner/blobs/sha256:a60ef8ec184edb5ed91f5983f00261359fb2fe20f603e8d488b9477d32fcad70 -> 307 to ... (signed CDN URL, cacheable) |
Unknown values 6
$.binding_noteboilerplate$.identity_cost.detailboilerplate$.per_object_cap.notesthe field may be stated in a source that was not read$.per_object_cap.statedthe field may be stated in a source that was not read$.retention.notesthe field may be stated in a source that was not read$.retention.statedthe field may be stated in a source that was not read