About Harbor

Overview

Harbor is an open source, CNCF Graduated artifact registry designed to securely store, manage, and distribute container images and other OCI artifacts. It extends the standard OCI/Docker Registry with enterprise-grade security, access control, vulnerability management, replication, and compliance features, making it ideal for Kubernetes-based software delivery pipelines.

Key Features

Security

  • Vulnerability scanning using pluggable security scanners
  • Image and artifact signing with signature verification
  • Role-Based Access Control (RBAC)
  • Integration with LDAP, Active Directory, and OpenID Connect (OIDC)
  • Audit logging for all repository operations
  • Project quotas and policy enforcement
  • Support for immutable tags to prevent accidental overwrites

Artifact Management

  • Stores OCI container images
  • Supports Helm charts
  • Supports OCI artifacts (SBOMs, WASM modules, signatures, and more)
  • Multi-project and multi-tenant repository organization
  • Powerful search and web-based management UI
  • REST API for automation and integrations

Replication & Distribution

  • Policy-based replication between Harbor instances
  • Replication to external registries
  • Repository filtering by project, repository, tag, or label
  • Supports hybrid cloud and multi-datacenter deployments
  • Retry mechanisms for failed synchronizations

DevOps & Kubernetes

  • Native Kubernetes integration
  • OCI-compliant registry
  • Compatible with Docker, containerd, CRI-O, Helm, ORAS, and other OCI clients
  • Integrates easily into GitOps and CI/CD pipelines
  • Helm Chart and Kubernetes Operator available for deployment

Typical Use Cases

  • Private enterprise container registry
  • GitOps artifact repository
  • Kubernetes image repository
  • Multi-site registry replication
  • Secure software supply chain
  • Air-gapped or on-premises container management
  • Central repository for signed and scanned OCI artifacts

Architecture

Harbor consists of several integrated services:

  • Registry – Stores OCI artifacts
  • Core Service – Authentication, authorization, project management, APIs
  • Database (PostgreSQL) – Metadata storage
  • Redis – Cache and job metadata
  • Job Service – Replication, scanning, garbage collection, and background tasks
  • Web Portal – Administrative UI
  • Proxy (NGINX) – API routing and frontend access
  • Scanner Integration – Vulnerability scanning via pluggable scanners

Highlights

Feature Support
OCI Registry ✓
Docker Images ✓
Helm Charts ✓
OCI Artifacts ✓
Vulnerability Scanning ✓
Image Signing ✓
RBAC ✓
LDAP / AD / OIDC ✓
REST API ✓
Replication ✓
Multi-Tenant Projects ✓
Immutable Tags ✓
Audit Logs ✓
Kubernetes Deployment ✓
CNCF Graduated ✓

Best For

Harbor is an excellent choice for organizations building cloud-native platforms that require:

  • Secure image storage
  • Enterprise authentication and authorization
  • Software supply chain security
  • GitOps workflows
  • Kubernetes-native deployments
  • Multi-site artifact replication
  • Compliance and auditability

Its combination of OCI compatibility, security features, and operational flexibility makes Harbor one of the leading self-hosted artifact registries for modern Kubernetes environments

Deployment

Deployment in our stack


https://forgejo.basicstack.de/basicstack/stack.basicstack.de/src/branch/main/apps/harbor