openskills.info
Course catalog
Harbor logoCourse Preview

Harbor

Harbor is an open-source registry for container images and other Open Container Initiative artifacts. It adds access control, security checks, replication, and lifecycle management around the storage used by build and deployment systems.

itCloud native tools and technologies

Don't Panic — Harbor

A container registry is a warehouse for container images and other artifacts. Build systems put things in; deployment systems take things out. Without any governance layer, that handoff is a crowd of unnamed people pushing and pulling from the same shelf. Harbor is the open-source registry that adds project boundaries, access control, vulnerability scanning, artifact signing, replication, and lifecycle policy on top of the standard OCI registry protocol.

The problem it solves is that a bare registry stores content but makes no decisions about who may push, who may pull, which artifacts carry known risk, or what should be deleted when it is no longer needed. Before Harbor, teams that needed those controls either bolted them together from separate tools or asked a cloud provider to handle it. Harbor bundles them into a single self-hosted service with a consistent API and web portal.

Everything else hangs off one idea: the project. A Harbor project is a namespace that groups repositories and applies its own access roles, scanning policy, retention rules, and quotas. If you understand that the project is the authorization boundary, the rest of the architecture makes sense. A robot account is a non-human identity scoped to one project. Tag immutability prevents a release tag from being overwritten by a later push. Garbage collection reclaims storage from blobs that no manifest references. None of these features is complicated in isolation; the difficulty is keeping them aligned so that a change in one area does not silently undermine another.

The thing that surprises most newcomers is that scanning and signing answer different questions. A vulnerability scan tells you what a scanner recognizes in the artifact's dependencies. Artifact signing with Cosign or Notation binds a digest to a trust policy. A clean scan does not make a signature unnecessary, and a valid signature does not mean the scan is clean. Teams that treat either one as sufficient discover the gap when an incident requires both provenance and vulnerability evidence.

If you are evaluating whether Harbor fits, read the Landscape tab for the market around self-hosted and cloud-managed registries. The Cheatsheet tab is the dense reference you will reach for when configuring projects, scanner adapters, or replication rules. The Quiz tab tests whether the mental model actually stuck. And the Timeline tab traces the decisions that turned a VMware internal project into a CNCF-graduated registry.

Where this skill leads

Relevant careers

See how this topic contributes to broader role-level skill maps.

Sources