Harbor

What is Harbor?

Harbor is an open source container registry that stores, signs, and scans your container images and OCI artifacts on infrastructure you control. It extends the standard registry with vulnerability scanning, role-based access control, and replication — a CNCF-graduated project first open-sourced by VMware in 2016.

What is Harbor best for?

Teams that need a private, self-hosted registry with real governance — image vulnerability scanning, project-level permissions, audit logs, and quotas — rather than pushing images to a public or third-party cloud. It fits organizations running Kubernetes or Docker who want security policy enforced at the registry, and no pull rate limits.

What can Harbor do?

• Store and serve container images, Helm charts, and other OCI artifacts through an OCI-compliant registry
• Scan images for known vulnerabilities with Trivy by default (Clair and Anchore are pluggable), including scan-on-push policies
• Sign and verify content with Cosign and Notation to enforce a trusted supply chain
• Enforce project-based role-based access control (RBAC), with LDAP/AD and OIDC single sign-on
• Replicate images across registries — other Harbor instances, Docker Hub, ECR, GCR, and more — with policy and retry
• Manage storage with per-project quotas, tag retention, immutable tags, and garbage collection
• Automate with robot accounts, webhooks, a full REST API, and detailed audit logging

Is Harbor free?

Yes — Harbor is completely free and open source under the Apache 2.0 license, with no paid tiers, enterprise edition, or feature gating. You only pay for the servers you run it on. There is no official managed Harbor cloud from the project, though some vendors offer hosted Harbor as a service.

Where does Harbor fall short?

• It is a registry, not a full container platform — it stores and secures images but doesn’t run or orchestrate them, so you still need Kubernetes, Docker, or a GUI like Portainer alongside it.
• The multi-service architecture (core, database, job service, registry, scanner, and more) is heavier than a plain registry; a small team pushing a few images may find single-binary registries simpler to operate.
• Content trust is in flux across the ecosystem — Notary v1 signing is deprecated in favor of Cosign/Notation, so signing workflows can shift between versions and need attention on upgrade.

What does Harbor replace?

Harbor is a self-hosted alternative to hosted registries like Docker Hub, Amazon ECR, and Azure Container Registry, and to commercial artifact platforms like JFrog Artifactory. It gives you the same store-scan-distribute workflow, plus signing and RBAC, while you keep the images and data on your own infrastructure.

FAQ

Is Harbor open source? Yes. Harbor is fully open source under the Apache 2.0 license and is a CNCF-graduated project — the first container registry to reach that status, in June 2020.

Can I self-host Harbor for free? Yes. Self-hosting is free with no paid edition; you only pay for the infrastructure it runs on. It installs via an official Docker Compose bundle or a Helm chart on Kubernetes.

Is Harbor a good Docker Hub alternative? Yes, when you want a private registry you control. Harbor adds built-in vulnerability scanning, project RBAC, replication, and no pull rate limits — features Docker Hub either lacks or puts behind paid plans — in exchange for running and maintaining it yourself.

What do I need to run Harbor? A Linux host with Docker (20.10.10-ce or newer) and Docker Compose (1.18.0 or later) for the Compose install, or a Kubernetes cluster for the Helm chart. It runs several containers, so give it adequate CPU, RAM, and storage.