Harbor

Harbor is an open-source, trusted cloud native container registry that stores, signs, and scans container images and Helm charts. Originally developed by VMware, Harbor is now a graduated project of the Cloud Native Computing Foundation (CNCF). It extends the open-source Docker Distribution by adding security, identity management, and policy features that enterprises require for production use.

Overview

Harbor was created by VMware in 2016 to provide an enterprise-grade container registry. It was donated to the CNCF in 2018 as a sandbox project, became an incubating project in 2019, and graduated in 2020. The current stable release is v2.15.2 (June 2026). Harbor is widely used as a private container registry in Kubernetes environments, offering features that the basic Docker Registry lacks: vulnerability scanning, RBAC, image signing, replication, and audit logging.

Key Features

  • Cloud native registry: Supports both container images (OCI/Docker) and Helm charts as first-class artifacts
  • Role-based access control (RBAC): Project-level permissions with user, maintainer, project admin, and system admin roles
  • Policy-based replication: Replicate images and charts between Harbor instances with tag/repository/label filters. Supports replication to and from Docker Hub, Amazon ECR, Azure ACR, Google GCR, and other registries
  • Vulnerability scanning: Built-in integration with Trivy and Clair for scanning images against CVE databases. Policy-based blocking of vulnerable images from being pulled
  • Image signing (Notary): Docker Content Trust support via Notary for image authenticity and provenance. Can enforce policies that prevent unsigned images from being deployed
  • OIDC and LDAP/AD authentication: Enterprise identity integration with OpenID Connect, LDAP, and Active Directory
  • Garbage collection: Automated cleanup of unreferenced blobs and manifests to reclaim storage
  • Audit logging: Full audit trail of all repository operations (push, pull, delete, scan)
  • RESTful API with Swagger: Complete API for administrative operations and integrations
  • Helm chart repository: Native Helm chart storage and distribution alongside container images
  • Quota management: Project-level storage quotas and limits
  • Graphical portal: Web UI for browsing, searching, and managing projects and repositories
  • Multiple storage backends: Local filesystem, S3, Azure Blob, GCS, OBS, COS, and more
  • Immutable tags: Prevent overwriting of tagged images for supply chain security

Technical Stack

  • Language: Go (backend), Angular (frontend)
  • Database: PostgreSQL
  • Registry core: Docker Distribution (open-source reference implementation)
  • Vulnerability scanners: Trivy (default), Clair (optional)
  • Signing: Notary v1 (Docker Content Trust)
  • Architecture: Microservices with reverse proxy (NGINX), core API server, job service, and registry
  • Deployment: Docker Compose, Helm chart for Kubernetes, Harbor Operator
  • API: RESTful API with embedded Swagger UI

Licensing

Harbor is fully open source under the Apache License 2.0. There is no commercial edition or enterprise tier. All features are available in the open-source version. Harbor is a CNCF graduated project, ensuring vendor-neutral governance.

Pricing

Edition Cost Notes
Harbor (OSS) Free Full-featured, all capabilities included. Community support via Slack, GitHub, and mailing lists.

Harbor is 100% free and open source. There is no paid edition.

Self-Hosting

Yes, Harbor is designed for self-hosting and is completely free. It can be deployed via Docker Compose on a single server, or on Kubernetes using the official Helm chart or Harbor Operator. Harbor runs on any Linux infrastructure with Docker and Docker Compose (or Kubernetes). It supports multiple storage backends including local filesystem, S3-compatible object storage, Azure Blob Storage, and Google Cloud Storage.

Official Resources