<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/">
  <channel>
    <docs>https://blogs.law.harvard.edu/tech/rss</docs>
    <title>ARM64 on Fuchsbau</title>
    <link>https://this-is-fine.io/tags/arm64/</link>
    <description>Recent content in ARM64 on Fuchsbau</description>
    <image>
      <title>ARM64 on Fuchsbau</title>
      <link>https://this-is-fine.io/tags/arm64/</link>
      <url>https://source.unsplash.com/2000x1322/?fox</url>
    </image>
    <ttl>1440</ttl>
    <generator>Hugo 0.125.4</generator>
    <language>de-DE</language>
    <lastBuildDate>Wed, 20 May 2026 22:26:11 UT</lastBuildDate>
    <atom:link href="https://this-is-fine.io/tags/arm64/index.xml" rel="self" type="application/rss+xml" />
    <item>
      <title>From Harbor to Zot on ARM64</title>
      <link>https://this-is-fine.io/posts/20251122-zot-instead-of-harbor/</link>
      <pubDate>Sat, 22 Nov 2025 10:00:00 UT</pubDate>
      <dc:creator>ff0x</dc:creator>
      <guid>https://this-is-fine.io/posts/20251122-zot-instead-of-harbor/</guid>
      <description>Harbor is a full registry product: scanning, replication, projects, and several backing services. On aarch64 it is also heavy, and it was a poor fit for four RK1 boards (ARM support is still catching up). After moving Talos from x86-64 to ARM64, Harbor stayed disabled in Git; Zot serves oci.this-is-fine.io instead.
Harbor shines when you want built-in scanning UI, replication policies, and a large operations surface. The lab mainly needed push, pull, sign, and admit — a smaller registry that speaks OCI and runs comfortably on ARM boards was the better fit.
</description>
      <category domain="https://this-is-fine.io/categories/infrastructure">Infrastructure</category>
      <content:encoded><![CDATA[Harbor is a full registry product: scanning, replication, projects, and several backing services. On aarch64 it is also heavy, and it was a poor fit for four RK1 boards (ARM support is still catching up). After moving Talos from x86-64 to ARM64, Harbor stayed disabled in Git; Zot serves oci.this-is-fine.io instead.
Harbor shines when you want built-in scanning UI, replication policies, and a large operations surface. The lab mainly needed push, pull, sign, and admit — a smaller registry that speaks OCI and runs comfortably on ARM boards was the better fit.
Harbor vs Zot Harbor (planned) Zot (running) Footprint Many pods (core, jobs, DB, Redis, &amp;hellip;) One registry process &#43; PVC ARM64 Not deployed here Fits the lab boards API Harbor-specific OCI — crane, skopeo, cosign GitOps Large Helm stack Slim release &#43; zot.json Hostname hub.this-is-fine.io (unused) oci.this-is-fine.io Harbor manifests remain in the repo for reference; the apps overlay does not enable them.
What Zot provides OCI-native push and pull (CI uses skopeo, not docker push — see Cosign &#43; Kyverno). Cosign signature storage and trust configuration. Optional Trivy search for CVE metadata. OpenID through Pocket ID for humans; htpasswd and robot users for automation. forge CI -&amp;gt; skopeo push oci.this-is-fine.io/zeroclaw/... -&amp;gt; cosign sign -&amp;gt; Kyverno verifyImages on pull Ingress is an HTTPRoute on shared-gateway-external. Large layer uploads use a long-timeout Envoy BackendTrafficPolicy.
CI robots authenticate with htpasswd while humans use OIDC (Pocket ID). That separation matters when Kyverno enforces signatures on pull: machines and people use different paths, but the same registry hostname.
What carried over Harbor projects and replication rules do not migrate literally, but OCI tags and cosign signatures do. The lab cared about:
Images built for the same architecture as the nodes (arm64 in .build.yml). Kyverno enforcing signatures on oci.this-is-fine.io/*. Lower RAM on a cluster that also runs Ceph, Mastodon, and monitoring. Related Envoy Gateway Pocket ID &#43; Zot ZeroClaw Docs: Zot configuration, why Zot.
]]></content:encoded>
    </item>
  </channel>
</rss>
