Harbor
An OCI registry that adds project-scoped RBAC, vulnerability scanning, replication, and signature verification on top of a plain Docker Distribution backend.
- Category: Supply Chain
- CNCF maturity: Graduated
- Language: Go
- License: Apache-2.0
- Repository: goharbor/harbor
- Documented at commit:
6872989(main, 2026-06-22)
What it is
Harbor is a self-hosted registry for container images and other OCI artifacts. It does not store blobs or manifests itself. It runs a reverse proxy in front of distribution/distribution (the Docker Registry) and inserts its own gates in front of that backend: authorization, quota, immutability, signature checks, and vulnerability policy.
The added value is everything an enterprise needs around a raw registry. Multi-tenant projects with role-based access control, LDAP/AD and OIDC login, policy-driven replication between registries, scheduled vulnerability scanning, image retention and garbage collection, and a web portal. The code is three Go binaries (an API core, an async job worker, and a registry controller) plus an Angular UI.
Harbor sits between your CI/CD system and your container runtimes. CI pushes images to a Harbor project, deploy targets pull from it, and Harbor enforces who can do what and which images are allowed to ship.
When to use it
- You need a registry you run yourself, on-premises or in a private cloud, rather than a managed cloud registry.
- You need multi-tenant isolation: many teams sharing one registry with per-project RBAC and quotas.
- You want scanning, signing, and replication built into the registry instead of bolted on around it.
- You replicate artifacts across data centers or air-gapped environments.
It is less compelling when a managed cloud registry (ECR, ACR, Artifact Registry) already covers your needs, or when you only need a single private registry with no access control, where plain Distribution is enough.
In this deep-dive
- History: origin at VMware and the path to CNCF Graduated.
- Architecture: the three binaries and the proxy-plus-middleware design.
- Adoption & Ecosystem: cited production adopters and alternatives.
- Internals: the image-pull path read from source.
- Getting Started: install with the offline installer.
Sources
- goharbor/harbor (README, ADOPTERS, LICENSE, VERSION), accessed 2026-06-22.
- goharbor/harbor at commit 687298935, accessed 2026-06-22.
- Harbor on CNCF (maturity dates and metrics), accessed 2026-06-22.
- CNCF announces Harbor Graduation, accessed 2026-06-22.
- Harbor: Enterprise-grade container registry for modern private cloud, accessed 2026-06-22.
- InfoQ: Open Source Registry Harbor's Graduation, accessed 2026-06-22.
- Harbor install & configuration guide, accessed 2026-06-22.
- gh api repos/goharbor/harbor, accessed 2026-06-22.