Content integrity
Blob digests are verified as content is written. Existing cached files are checked before trusted reads, with corruption recovery and background scrubbing.
How integrity works →Open source · Kubernetes · containerd
Move container images.
Not the same bytes twice.
A node-local, peer-assisted OCI registry cache that helps Kubernetes clusters reuse image content across nodes — especially where bandwidth is limited or registry access is unreliable.
Designed for containerd-based Kubernetes clusters. The sample deployment requires environment-specific TLS and image configuration.
IMAGE PULL FLOWCONTENT-ADDRESSED
containerdImage pull request
OCI / HTTPS
Local SIC cacheDigest-verified content1
Peer cachesCluster-local reuse2
UpstreamOptional allow-listed fallback3
BUILT FOR THE HARD PARTS
Cache behavior you can reason about.
Image caching is only useful when correctness, resource limits, and failure behavior are explicit.
Peer-assisted reuse
Nodes discover ready peers through the Kubernetes API. Peer requests stay cache-only to avoid recursive miss loops.
Explore the request path →Bounded storage
Free-space reserves and optional cache caps trigger LRU eviction before a download is admitted or rejected.
Storage and eviction →Operational visibility
Prometheus metrics, health checks, explicit failure responses, and TLS diagnostics help operators understand cache behavior.
Metrics and health →HOW IT FITS
A local cache with a cluster-wide memory.
Each node runs SIC beside containerd. SIC can import existing content from containerd, serve local cache hits, ask other ready SIC peers, and optionally fall back to explicitly allow-listed registries.
It uses containerd's gRPC content APIs rather than scraping containerd's on-disk layout or invoking a ctr subprocess.
01 containerd requests an OCI blob 02 SIC checks the local content cache 03 cache miss → probe ready peers 04 optional allow-listed upstream 05 verify digest before publishing 06 reserve space / evict if needed
✓ Content-addressed · TLS protected · Observable
Release status: v1.0.0 readiness is still conditional on release-wide CI, security review, and real-cluster validation. This site documents the current repository; it does not imply production certification. See published releases for actual release artifacts.