Container Registry and Software Supply Chain Platform  ·  View 14 of 33  ·  3 · Data

Multi-Region Topology

What replicates, what caches, and what an artifact does when its evidence has not arrived yet.

Editable source SVG draw.io All views
DC-1 — write region for this repository set Artifact plane Harbor Origin push accepted here MinIO Primary 14 TB Evidence plane Attestation Store primary Evidence Topic ordered per subject Rekor Metadata PostgreSQL Primary regional writes DC-2 — read region Artifact plane Proxy Cache absorbs pull storms MinIO Replica async · RPO 15 min Evidence plane Evidence Replica ordered per subject Unreplicated Evidence deny, retryable Metadata PostgreSQL Replica read only Edge and air-gapped sites Offline island Local Registry zot · seeded Evidence Bundle signed · transported Offline Trust Root TUF · 30 d validity Clusters in DC-1 Clusters in DC-2 Edge Clusters async blobs ordered replication streaming regional read signed transfer Multi-Region Topology — Replicate, Cache, Isolate Interface / broker Data store Queue / topic Security / platform Risk / gap External / third party batch event / async synchronous Admission in a region reads evidence from that region. Adding a region changes no trust relationship. v 1.0 · owner Enterprise Architecture · date 2026-09

Answering question 6

  • Blobs cache, evidence replicates, metadata stays regional with a designated write region per repository
  • Full registry replication was rejected: it multiplies 14 TB per region to solve a problem the cache already solves for 97% of pulls
  • One global registry was rejected: it concentrates both cost and failure, and cannot meet the 250,000-pull burst without cross-region egress

The rule that keeps it honest

  • Admission in a region reads evidence from that region
  • An artifact whose evidence has not replicated is denied with a retryable reason, never allowed
  • Adding a region requires no change to the trust model and no global synchronous write

Risks

  • Evidence replication lag becomes a deployment-blocking condition; it needs an SLO and an alert, not just a metric
  • The air-gapped island depends on a human transporting a signed bundle; its trust roots expire in 30 days by design
◀  Component Index All views Build to Attested Push  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises14-multi-region-topology