Get your free Kubernetes ML guide

The Security and Governance
Layer for Kubernetes AI

The On-Prem AI Security Platform

Try Jozu in your Environment View Demo

On-prem, private cloud, or fully air-gapped. Jozu packages models as OCI artifacts, gates them with policy, and deploys them to any Kubernetes distribution with the pipelines you already run.

WHY JOZU

Your AI Security Control Point

Jozu isn't just another model registry. It's the security and governance layer for your entire Kubernetes AI stack. Jozu Hub ensures every model, agent, and MCP server is scanned, signed, and governed before deployment. Jozu Agent Guard enforces policy at runtime, with tool-level access control, guardrails, and human-in-the-loop, inside contained execution environments. KubeFlow handles training pipelines. KServe/LLM-D manages serving. Jozu secures everything in between.

Built on Open Standards

Jozu packages your AI projects using the CNCF KitOps project. KitOps is the reference implementation of the CNCF's ModelPack specification, a vendor-neutral industry standard trusted in production across global enterprises and governments.

Enterprise Security
& Compliance

Jozu features automated security scanning with policy enforcement. It uses tamper-evident packaging with SHA-based attestation, and features complete audit trails for EU AI Act, ISO 42001, and NIST AI RMF compliance.

Created for Kubernetes

Jozu was designed to work with enterprise Kubernetes development stacks. It works seamlessly with the tools your team already uses like Podman, MLflow, Kubeflow, KServe, LLM-D, Openshift, and more.

On-Prem, or even
Air Gapped

Unlike SaaS solutions, Jozu installs behind your firewall, ensuring that no data leaves your environment and nothing is visible to Jozu. All while remaining vendor neutral and avoiding vendor lock-in.

How it works

A secure, end-to-end workflow for training, governing, and serving ML models on-premises.

1. KitOps

packages models as secure ModelKits and pushes to Jozu

2. Kubeflow Pipelines

pulls secure ModelKits from Jozu to train and validate models

3. Jozu

trained models are scanned for vulnerabilities and license issues then signed and prepared for deployment

4. KServe

pulls only verified and approved models from Jozu for inference

How Jozu Enhances Kubeflow

The Gap in Kubeflow

KubeFlow excels at orchestrating training pipelines but has:

  • No Tamper-evident model storage

  • No Security scanning for model artifacts

  • No Supply chain attestations for compliance

  • No Deployment governance and approval workflows

The Jozu Solution

Jozu adds enterprise control to your KubeFlow pipelines that:

  • Packages trained models as ModelKits

  • Executes multiple levels of vulnerability scanning

  • Adds security attestations and signatures

  • Makes models available for governed KServe deployment

Architecture: Built for Security &
Governance

Without Jozu:

Fragmented workflows requiring manual packaging and scanning. Increased risk of deployment errors and compliance gaps.

Kubeflow
No scanning
S3/MinIO
No governance
No lineage
KServe

With Jozu:

End-to-end automated packaging, scanning, and registry integration. Streamlined, reproducible, and production-ready ML pipelines.

Kubeflow
Scanned
Signed
Attested
Jozu Hub
Governed
Lineage
Audited
KServe

Why Not Just Use
Kubeflow Model Registry?

The KubeFlow Model Registry focuses on metadata management, tracking parameters, metrics, and experiments. It's essentially a database of information about your models.

Building Effective Kubeflow Model Registry:

Kubeflow
Model Registry
Experiment metadata
Security scanning
Cryptographic
SBOM generation
Immutable storage
Jozu Hub
Production
Deployment
Secure Pipelines
Governed
Services

Jozu provides what Kubeflow Model Registry doesn't:

  • Security scanning of actual model artifacts and dependencies
  • Cryptographic signing to prevent tampering
  • Deployment policies that enforce governance
  • SBOM generation for supply chain security
  • Immutable storage that ensures model integrity

Use both together:

  • Kubeflow Model Registry for experiment metadata
  • Jozu for security, governance, and production deployment

Why Kubeflow users love Jozu

  • Keep your existing pipelines unchanged
  • Add security scanning with one component
  • Get deployment-ready artifacts automatically
  • Maintain your training workflows as-is

The Registry Comparison

Jozu integrates with the tools your DevOps team already knows and trusts.

Feature
Kubeflow Model Registry
S3/MinIO
Jozu Hub + Agent Guard
Lineage Tracking
Experiments only
None
Full lifecycle
Security Scanning
No
No
Multiple vectors
Tamper Protection
No
No
Cryptographic
Deployment Governance
No
No
Policy-based
KServe Integration
Basic
Basic
Secured and governed
SBOM Generation
No
No
Yes
Audit Trails
Limited
Limited
Full lifecycle
Runtime Policy Enforcement
No
No
ToolPolicy + GuardrailPolicy via Agent Guard
RAPID INFERENCE CONTAINERS

From push to serving, without the build step

Rapid Inference Containers are composed at pull time: your hardened, already-approved base image, the model weights from the ModelKit, and the configuration metadata, merged when the container runtime pulls. No CI build, no image sprawl, no new attack surface, because the base layer is already inside your vulnerability management workflow. The same ModelKit serves different runtimes by changing one path segment in the pull URL.

In internal testing a Llama 3.2 8B model was serving in 42.8 seconds versus 425.4 seconds for a conventional container build.

CI/CD INTEGRATION

Works inside the pipelines you already run

Your CI/CD, unchanged

Jenkins, GitLab CI, GitHub Actions, Dagger, and OpenShift Pipelines. Models are packaged with the Kit CLI or Python SDK, stored in your existing OCI registry, scanned, and deployed through your normal automation. Jozu adds gates to your pipeline; it does not replace the pipeline.

Scanning in the workflow

Scanning runs automatically on push to Hub, covering the nine vulnerability classes. Results are tracked per version, and pulls or deployments are blocked when digests and signatures don't match.

Deployment, gated

Your pipeline pulls the signed ModelKit, Jozu validates the digest against the signature, and only validated artifacts deploy, to EKS, AKS, GKE, OpenShift, or any distribution.

Why OCI

Layer-based storage, immutable versioning through tags and digests, cryptographic verification, and native Kubernetes support. Your DevOps team already knows this toolchain; your models just join it.

Request your free Jozu trial

Interested in testing Jozu in your private environment? Download the Helm Chart, and start your 2-week trial.

  • STEP 1

    Install

    Jozu Hub can be installed in your environment in just 1-hour, with no disruptions to existing workflows. We suggest taking a baseline measurement of current deployment times and security gaps, to benchmark against.

  • STEP 2

    Evaluate

    Once installed, you can run real-world tests with your models and infrastructure for up to 2-weeks. This will allow you to measure Jozu's performance against your existing tools and processes.

  • STEP 3

    Review

    At the end of your 2-week trial our team will work with you to review your results, and help you quantify improvements and ROI. This includes an implementation and roadmap discussion.

FAQS
Can Jozu Hub import models from Hugging Face and package them as CNCF-compliant ModelKits?
Yes. Hugging Face to ModelKit import is a core workflow. You provide the Hugging Face URL, and Jozu imports the model, packages it in a vendor-neutral format, and stores it in your enterprise registry. This import process gives AI/ML teams access to vetted and secured base models they can build on, without hand-crafting containers for each model. Jozu gives your organization a curated catalog of approved models from public sources like Hugging Face, scanned for security issues and license compliance. This replaces the “shadow” imports teams do by pulling from unvetted public sources to base their production-future work on.
How does Jozu Hub's approach differ from MLflow, Kubeflow, or other AI platforms?
Jozu isn't replacing your experiment tracking or ML pipeline tools - it's adding the security and deployment layer they lack. MLflow and Weights & Biases handle model development and experiment tracking. Kubeflow and cloud platforms (Sagemaker, Seldon, Vertex) handle training orchestration and inference serving. Jozu fills the gap between development and production with signed packaging, security scanning, policy enforcement, and optimized deployment.
How does Jozu Hub optimize model delivery to Kubernetes clusters by 7x?
Jozu’s Rapid Inference Containers (RIC) are optimized for rapid loading. Traditional approaches rebuild containers and transfer full model weights for each deployment. Jozu uses layer-deduplication (unchanged components aren't re-transferred), pre-configured inference containers, and optimized delivery to CPUs/GPUs. Real world deployments see 7x faster time to first token response compared to standard container, streaming, or NVIDIA NIM approaches. With AI agents and composite AI applications requiring larger, more complex deployments, this optimization becomes critical for production SLAs.
What's the maximum size of models and datasets that can be packaged as ModelKits?
Large model packaging with ModelKits leverages OCI's layer-based architecture, which handles multi-gigabyte files efficiently. ModelKit sizes aren’t limited in Jozu’s built-in registry, but using an external registry may limit sizes based on their own arbitrary limits. Large models especially benefit from ModelKit packaging due to OCI’s layer deduplication: when you update a 70B parameter model, only the changed layers transfer - you're never re-uploading hundreds of gigabytes for configuration changes.
How does Jozu Hub handle multi-modal models and large language models in CI/CD pipelines?
Multi-modal CI/CD works through ModelKits that package all model components - vision encoders, language models, fusion layers - as separate versioned layers. LLM pipeline deployment benefits from Jozu's optimized delivery, which is critical when models reach hundreds of gigabytes. Enterprise LLM management features include differential versioning (see exactly which components changed between versions), security scanning tailored for LLM-specific risks, and inference containers pre-configured for GPU serving.
How do developers push and pull ModelKits in their CI/CD workflows?
ModelKit push pull operations use the kit CLI with familiar syntax. Developers run kit push registry.example.com/org/model:v1.0 to upload ModelKits and kit pull registry.example.com/org/model:v1.0 to retrieve them. CI/CD developer workflow integration works with any OCI-compliant registry using existing credentials. Automated model versioning tracks each push with SHA digests and optional semantic tags. From experiment trackers like MLflow, the pykitops Python library captures model lineage and generates ModelKits programmatically. Pipeline scripts simply call the CLI commands, and Jozu handles security scanning, signing, and validation automatically.
Can we automatically trigger model retraining and repackaging through our CI/CD pipeline?
Yes. Automated retraining pipeline triggers work through your existing CI/CD systems. When training completes (whether in MLflow, Weights & Biases, or custom scripts), the pipeline calls kit pack to create a new ModelKit version, then kit push to upload it. CI/CD model updates trigger Jozu's security scanning automatically. Continuous model delivery can include automated validation gates - if security scans pass and attestations validate, the new version promotes through environments. Your pipeline orchestrates the workflow; Jozu provides the packaging, scanning, and deployment infrastructure. This replaces ad-hoc scripts with a governed, auditable process.
How does Jozu govern agents and MCP servers in Kubernetes?
Jozu Agent Guard deploys to Kubernetes as a contained execution environment. Agents, models, and MCP servers run inside protected runtimes with ToolPolicy enforcing per-tool access control and GuardrailPolicy filtering inference requests. Policies are distributed as OCI artifacts through the same registries you use for containers. The same governance that protects your Kubernetes cluster extends to every agent action.