TiloBox
Back to directory
Harbor project preview
Devops InfrastructureAlternative to Docker Hub ProAlternative to Quay

Harbor

Enterprise cloud-native container image and artifact registry with vulnerability scanning.

View on GitHub Visit website
LicenseApache-2.0
GitHub stars29.2k
Last commit1 weeks ago
Tags6 topics
KubernetesHelmRegistryVulnerability ScannerSecurityDocker
Overview

Why consider Harbor?

Harbor is an open-source trusted registry that stores, signs, and scans container images and Helm charts. It features role-based access control, LDAP integration, and image replication.

Guided learning

Learn Harbor by building

Practical setup notes, real use cases, and copy-ready examples in one focused guide.

3 min read 10 sections
In this guide10 sections

What is Harbor?

Harbor is an open-source, enterprise-class container image and artifact registry hosted by the Cloud Native Computing Foundation (CNCF). It provides a secure, private alternative to commercial container registries like Docker Hub Pro, Quay, and AWS Elastic Container Registry (ECR).

Harbor extends the open-source Docker Distribution by adding essential enterprise capabilities: automated vulnerability scanning (via Trivy), cryptographic image signing with Cosign and Notary, granular role-based access control (RBAC), multi-tenant project isolation, and bidirectional registry replication.

Who Is It For?

  • Enterprise Security & DevSecOps Teams: Enforcing security policies that automatically block the deployment of container images with critical CVE vulnerabilities.
  • Kubernetes Administrators: Hosting internal container images, OCI artifacts, and Helm charts within private VPC networks without third-party egress fees.
  • Continuous Integration Engineers: Integrating private container image push/pull workflows with automated vulnerability scanning in CI/CD pipelines.

Key Features

  • Multi-tenant project management with granular user roles and LDAP/Active Directory/OIDC integration.
  • Integrated vulnerability scanning for container images using open-source Trivy scanners.
  • Cryptographic artifact signing and verification preventing deployment of unverified container images.
  • Multi-registry replication allowing synchronization between Harbor instances, Docker Hub, AWS ECR, and Google Artifact Registry.
  • Support for OCI-compliant artifacts including Docker images, Helm v3 charts, and WebAssembly modules.

Installing Harbor with Docker Compose

Download the official Harbor offline installer on an Ubuntu/Debian server:

bash
1# 1. Download installer package
2wget https://github.com/goharbor/harbor/releases/download/v2.15.2/harbor-offline-installer-v2.15.2.tgz
3tar xzvf harbor-offline-installer-v2.15.2.tgz
4cd harbor
5
6# 2. Configure harbor.yml parameters
7cp harbor.yml.tmpl harbor.yml

Edit harbor.yml to set your domain name and SSL certificates:

yaml
1hostname: registry.example.com
2http:
3 port: 80
4https:
5 port: 443
6 certificate: /etc/ssl/certs/harbor.crt
7 private_key: /etc/ssl/private/harbor.key
8harbor_admin_password: StrongAdminPassword123

Run the installer with vulnerability scanning enabled:

bash
1sudo ./install.sh --with-trivy

Log in via your terminal:

bash
1docker login registry.example.com
2docker tag my-app:latest registry.example.com/production/my-app:latest
3docker push registry.example.com/production/my-app:latest

Practical Use Cases

1. Automated CI/CD Vulnerability Gate

A CI pipeline builds a container image and pushes it to Harbor; Harbor automatically runs a Trivy scan and blocks Kubernetes from pulling the image if any High/Critical CVEs are discovered.

2. Multi-Region Registry Synchronization

A global organization pushes images to a primary Harbor registry in Europe, which automatically replicates approved images to secondary Harbor registries in North America and Asia.

3. Private Helm Chart Repository

A cloud-native team stores custom Kubernetes Helm charts alongside container images in Harbor, utilizing a single authentication credential for all deployment artifacts.

Troubleshooting and Limitations

  • HTTPS Requirement for Docker Client: Docker daemon enforces HTTPS for private registries by default; ensure valid TLS certificates are installed or configure insecure-registries in /etc/docker/daemon.json for local testing.
  • Disk Storage for Image Layers: Harbor stores full image layers and Trivy CVE databases; ensure the data partition has adequate NVMe/SSD storage and configure image tag retention rules to prune untagged layers.

Official Resources

Related tools

More options with a similar category or technology profile.

Dapr CLI logo

Dapr CLI

Command-line tool for managing Dapr distributed application runtime environments and sidecars.

bpytop logo

bpytop

Python port of bashtop with game-like UI, responsive mouse support, and hardware sensors.

bashtop logo

bashtop

Linux resource monitor showing usage and stats for processor, memory, disks, network, and processes.

SchemaHero logo

SchemaHero

Kubernetes-native declarative database schema management and table migration operator.

Harbor FAQs

Harbor is listed as a Devops Infrastructure tool on TiloBox. Review the overview, features, and official documentation on this page to decide whether it solves your specific workflow.

Start with the project's GitHub repository and official website for supported installation and deployment instructions. Test the setup with representative data or a small project before rolling it out more widely.

Harbor is listed under the Apache-2.0 license. Read the complete license text and the project's notices before using, modifying, or distributing the software.

Production readiness depends on your requirements. Review maintenance activity, security practices, documentation, backup and upgrade procedures, and compatibility with your stack; then validate it in a non-production environment.

Harbor is listed as an alternative to Docker Hub Pro. Compare the core workflow, deployment model, integrations, and licensing against your must-have requirements before switching.