Harbor

Harbor decouples authentication from the registry itself, supporting integration with LDAP, Active Directory, and OIDC providers. Once authenticated, fine-grained role-based access control governs every operation:

• Project-level isolation: Each project is a namespace with its own user, robot account, and role assignments
• Robot accounts: Machine identities with narrowly scoped permissions for CI/CD pipelines
• Audit logging: Every pull, push, and delete action is recorded for compliance

Beyond container images, Harbor functions as a generic OCI-compliant artifact repository. It can store and serve any content type that adheres to the OCI distribution specification, including:

• Helm charts: Versioned Kubernetes application packages
• Cosign signatures: Cryptographic attestations stored alongside images
• SBOMs and provenance: Supply chain metadata attached as referrer artifacts This unified storage model eliminates the need for separate artifact registries.

Harbor provides automated storage reclamation through garbage collection and tag retention policies. These mechanisms prevent unbounded storage growth in production registries:

• Garbage collection: Removes untagged manifests and unreferenced layer blobs
• Retention policies: Automatically delete images based on tag count, age, or vulnerability severity
• Quota management: Enforce per-project storage limits to prevent resource exhaustion

Harbor can operate as a pull-through proxy cache, mirroring upstream registries like Docker Hub or Quay.io. This capability is essential for air-gapped or bandwidth-constrained deployments:

• Local caching: First pull fetches from upstream; subsequent pulls serve from local cache
• Offline operation: Pre-populate the cache before disconnecting from external networks
• Bandwidth reduction: Eliminate redundant external downloads across large node fleets

A Software Bill of Materials is a nested inventory of all components, libraries, and dependencies within a software artifact. Harbor can generate and store SBOMs in SPDX or CycloneDX formats, providing deep supply chain transparency. This allows security teams to quickly identify if a newly disclosed vulnerability (like a Log4Shell variant) impacts any image stored in the registry by querying the SBOM rather than rescanning every layer.

A Kubernetes-native plugin that intercepts API requests and can validate or mutate objects before they are persisted. When integrated with Harbor, an admission controller can enforce policies such as:

• Only allow images from a specific Harbor project
• Block images with critical vulnerabilities
• Require valid Cosign signatures This prevents non-compliant workloads from ever being scheduled on the cluster.

A local, read-only replica of an upstream registry that serves as a pull-through cache. In air-gapped or bandwidth-constrained environments, a Harbor instance can be configured as a proxy cache for registries like Docker Hub or Quay.io. This drastically reduces external bandwidth consumption and ensures that images remain available for pulling even if the upstream source is temporarily unreachable.

A security framework (Supply-chain Levels for Software Artifacts) that provides a tamper-proof, attestable record of an artifact's build process. Harbor stores SLSA attestations as OCI artifacts, linking each image to verifiable metadata about its origin—including the builder, source repository, and build steps. This creates an auditable chain of custody from source code to deployed container, critical for meeting compliance requirements.