Harbor

What Harbor is

Harbor is a free, open-source registry for managing artifacts across cloud-native platforms such as Kubernetes and Docker. It provides a web interface and extensible API, and can be installed on Kubernetes or a system with Docker support. Security features include policies, role-based access control, vulnerability scanning, and image signing and validation. Scanning uses Trivy when enabled during installation, and Harbor can connect to additional scanners. It replicates images and charts between Harbor and other registries in pull or push mode; listed integrations include Docker Hub, Amazon ECR, Google Container Registry, Azure Container Registry, and GitLab Registry. Authentication options include a database, LDAP/Active Directory, and OIDC. Selecting database authentication and adding local users prevents switching to another mode. Project storage quotas are unlimited by default but can be set globally or for individual projects. Harbor is a Cloud Native Computing Foundation Graduated project. HTTPS is recommended for production; HTTP outside air-gapped test or development settings exposes connections to man-in-the-middle attacks. Robot account secrets must be saved when created, and robot accounts cannot log into the user interface.

Who it suits

Harbor suits teams managing container images and other artifacts across cloud-native environments who need registry controls, scanning, or replication.

Limits

Project storage quotas are unlimited by default, but can be set globally or per project. Robot account secrets must be saved when created, and robot accounts cannot access the user interface.

Getting started

1. Visit the Harbor website.
2. Install Harbor on Kubernetes or on a system with Docker support.
3. Enable Trivy during installation if you want image vulnerability scanning.
4. Choose an authentication mode: database, LDAP/Active Directory or OIDC.
5. Use HTTPS for production deployments.

Verdict

Harbor combines artifact storage with access controls, scanning, and registry replication. Production deployments should use HTTPS, and authentication choices and robot account limits warrant attention.