Logo
Deploy Now

Categories

DevOps Security Docker CI/CD Cloud Native Kubernetes Container Registry

Stars

29,197

Forks

5,312

Watchers

516

Developer links

Last Updated: 08-21-2026 09:17 AM (UTC)

Harbor

The first container registry to reach CNCF graduated status with over 29,000 GitHub stars since VMware open-sourced it in 2016, Harbor transforms the basic Docker Distribution into a hardened enterprise registry with vulnerability scanning, supply chain signing, multi-datacenter replication, and project-level access control out of the box. Trivy scans every pushed image against the NVD, GitHub Advisory Database, and distribution-specific vulnerability feeds, with scan-on-push policies that block deployment of images exceeding configurable severity thresholds. Artifact signing through Cosign keyless signatures and Notation enforces content trust policies ensuring only cryptographically verified images reach production clusters. Policy-based replication synchronizes images and Helm charts between Harbor instances across multiple datacenters using repository, tag, and label filters with automatic retry and bandwidth throttling — enabling hybrid-cloud and disaster-recovery topologies. The RBAC model isolates projects with per-project quotas, robot accounts for CI/CD automation, webhook notifications, and audit logging that tracks every pull, push, delete, and configuration change. LDAP, Active Directory, and OIDC authentication integrate with existing identity providers, while the proxy cache transparently caches images from Docker Hub, Quay, and other upstream registries to reduce pull latency and rate-limit exposure. The RESTful API with embedded Swagger UI, tag retention policies, garbage collection scheduling, and immutable artifact rules complete the lifecycle management. Deploy via Docker Compose or Helm Chart on Kubernetes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache 2.0 licensed.

Harbor
Harbor
Harbor
Harbor
Harbor

Benefits

  • Integrated Vulnerability Scanning Pipeline
  • Trivy scans every pushed image against NVD, GitHub Advisories, and OS-specific feeds with configurable severity thresholds that block vulnerable artifacts from reaching production deployments.
  • Supply Chain Trust and Signing
  • Cosign keyless signatures and Notation enforce content trust policies, ensuring only cryptographically verified images pass admission control in Kubernetes clusters and CI/CD pipelines.
  • Multi-Datacenter Image Replication
  • Policy-based synchronization replicates images between Harbor instances using repository, tag, and label filters with automatic retry and bandwidth throttling for hybrid-cloud topologies.
  • Enterprise Identity Integration
  • LDAP, Active Directory, and OIDC authentication with project-level RBAC, robot accounts for automation, per-project quotas, and comprehensive audit logging of every registry operation.

Features

  • Proxy Cache
  • Transparently caches images from Docker Hub, Quay, and upstream registries locally, reducing pull latency and avoiding Docker Hub rate limits for development teams.
  • Tag Retention Policies
  • Configurable rules automatically retain or remove tags based on age, count, and pattern matching, combined with immutable artifact rules preventing accidental overwrites.
  • Garbage Collection
  • Scheduled background garbage collection reclaims storage from unreferenced blobs without downtime, with dry-run mode for previewing space savings before execution.
  • RESTful API with Swagger
  • Comprehensive REST API with embedded Swagger UI for exploring and testing every administrative operation, enabling integration with CI/CD systems and custom automation.
  • Helm Chart Repository
  • Native storage and management of Helm charts as OCI artifacts alongside container images, with the same security scanning, signing, and replication policies applied uniformly.