- Category
- Developer Tools
- Rank
- No. 146Tools index
- Pricing
- Open Source
- Type
- TOOL
- Builder
- goharbor
- GitHub
- 29.3k stars
- Latest release
- v2.15.2
- Date
About
An open source cloud native registry that stores, signs, and scans container images and Helm charts. It extends Docker Distribution with enterprise features like security scanning, access control, replication, and user management for container environments.
What it does
Harbor gives teams a governed home for software artifacts. Administrators divide repositories into projects, assign permissions, connect corporate identity, synchronize content across sites, and expose artifacts through a web portal and APIs. Automated checks can block vulnerable or unsigned images before deployment.
Why it's ranked here
Harbor makes a strong case for organizations running private container infrastructure across teams or locations. Its combination of project-level permissions, LDAP and OpenID Connect integration, policy-driven replication, vulnerability gates, audit logs, garbage collection, and programmable administration covers unusually broad operational ground.
What's good
Replication policies filter by repository, tag, and label, retry failures automatically, and support multi-site deployments. Security controls reach beyond scanning: Harbor can reject vulnerable or unsigned images. The embedded Swagger interface, graphical portal, audit trail, Prometheus metrics, and REST API give operators several practical ways to manage and observe it.
Tradeoffs
This is a multi-service system, not a lightweight registry process. It includes core, job, registry control, database, cache, proxy, portal, and optional scanning or metrics components. Linux installation requires Docker and Compose, while Kubernetes uses a separate chart. The project also warns that its main development branch may be unstable or broken, so operators should consume releases.
How to use it well
Use Harbor when several teams need controlled artifact distribution, corporate authentication, security policy, auditing, or replication between data centers and clouds. Place it near build and runtime environments to reduce image-transfer distance. Prefer signed release installers or the Kubernetes chart. It does not replace container runtimes or orchestration platforms; it supplies artifacts and policy controls to them.
Technical notes+
The Makefile builds separate Go binaries and container images for core, job service, registry control, database migration, and exporting, plus an Angular portal. src/core/main.go initializes Redis-backed caching and sessions, PostgreSQL migrations, authentication providers, scanning, auditing, tracing, metrics, notifications, and graceful shutdown. src/server/server.go mounts service, UI, OCI registry, and versioned API routes. src/jobservice/main.go runs background work through a dedicated runtime, while src/registryctl/main.go wraps registry storage drivers including filesystem, Azure, GCS, S3, Swift, and OSS. src/cmd/exporter/main.go exposes Prometheus collectors, and src/portal/app-swagger-ui/src/index.js renders the administrative API with CSRF handling.
Observed
- License
- Apache License 2.0
- Primary language
- Go, with an Angular and TypeScript web portal
- Install surface
- Release binaries for Docker Compose on Linux, plus a separate Helm chart for Kubernetes
- Interfaces
- Graphical web portal, REST API, embedded Swagger UI, and OCI registry APIs
- Identity support
- LDAP, Active Directory, and OpenID Connect
- Observability
- Audit logs, health checks, tracing initialization, and Prometheus metrics
- Packaging structure
- Separate core, job service, registry controller, exporter, database migrator, and portal components
Read from README.md, Makefile, src/core/main.go, src/server/server.go, src/jobservice/main.go, src/registryctl/main.go, src/portal/src/main.ts, src/cmd/exporter/main.go, src/lib/metric/server.go, src/jobservice/api/server.go, src/cmd/standalone-db-migrator/main.go, src/portal/src/app/index.ts, src/portal/app-swagger-ui/src/index.js, src/portal/server/controllers/index.ts, src/controller/artifact/manifest/index.go.
What it can do
Store container images and Helm charts
Container images and Helm charts → Stored registry artifacts
Digitally sign container images
Container images → Cryptographically signed container images
Scan container images for vulnerabilities
Container images → Vulnerability scan reports
Control access to registry resources
User credentials and permission policies → Authorized or denied access to container images and charts
Replicate container images across registries
Container images and replication policies → Synchronized container images in target registries
Manage user accounts and authentication
User information and authentication credentials → User accounts with authentication tokens
Intel on Harbor
Tags
Media
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.