Harbor — Cloud Native Trusted Container Registry

What it is

Harbor is a CNCF-graduated open-source container registry that stores, signs, and scans container images and OCI artifacts. It provides vulnerability scanning (via Trivy), role-based access control (RBAC), image replication across registries, and content trust through Cosign/Notary. Harbor adds enterprise security features on top of the Docker distribution.

Harbor is designed for platform teams and organizations that need a private container registry with security, compliance, and multi-site replication capabilities.

How it saves time or tokens

Using Docker Hub for private images means trusting a third party with your container images and paying for private repository limits. Harbor gives you a self-hosted registry with enterprise features at zero licensing cost. Vulnerability scanning runs automatically on every push, RBAC controls who can access each project, and replication keeps registries synchronized across data centers. These features would require multiple tools or an expensive commercial registry.

How to use

1. Download and install Harbor:

wget https://github.com/goharbor/harbor/releases/download/v2.11.0/harbor-offline-installer-v2.11.0.tgz
tar xvf harbor-offline-installer-v2.11.0.tgz
cd harbor
cp harbor.yml.tmpl harbor.yml
# Edit harbor.yml: set hostname, HTTPS certificates, passwords
./install.sh

1. Log in and push an image:

docker login harbor.example.com
docker tag my-app:latest harbor.example.com/myproject/my-app:latest
docker push harbor.example.com/myproject/my-app:latest

1. Harbor automatically scans the pushed image for vulnerabilities. View results in the web UI.

Example

Configuring Harbor for automated vulnerability scanning and replication:

# harbor.yml (key settings)
hostname: harbor.example.com
https:
  port: 443
  certificate: /etc/ssl/harbor.crt
  private_key: /etc/ssl/harbor.key

# Enable Trivy scanner
trivy:
  enabled: true
  skip_update: false

# Database
database:
  password: harbor-db-password
  max_open_conns: 100

After installation, configure replication rules in the web UI to sync images to a secondary Harbor instance for disaster recovery.

Related on TokRepo

• DevOps tools — Browse container and registry tools
• Security tools — Explore container security solutions

Common pitfalls

• Not configuring HTTPS. Harbor should always run with TLS in production. Docker clients refuse to push to insecure registries by default. Set up certificates before deploying.
• Ignoring vulnerability scan results. Harbor scans images automatically, but you must configure policies to block deployment of images with critical vulnerabilities.
• Not setting up garbage collection. Deleted image tags still consume disk space until garbage collection runs. Schedule periodic GC jobs to reclaim storage.
• Starting with an overly complex configuration instead of defaults. Begin with the minimal setup, verify it works, then customize incrementally. This approach catches configuration errors early and keeps troubleshooting straightforward.

For teams evaluating this tool, the time saved on initial setup alone justifies the adoption. The well-documented API and active community mean most common questions have already been answered, reducing the learning curve and the number of tokens spent explaining basic usage to AI assistants.