goharbor/harbor
Harbor
Harbor is a self-hosted, enterprise-grade container registry platform designed to store, sign, and scan container images and cloud-native artifacts. It provides a centralized repository that integrates directly with Kubernetes environments to manage the full lifecycle of software artifacts, from initial storage to production deployment.
The platform distinguishes itself through a focus on security, governance, and multi-site availability. It features a pluggable vulnerability scanning framework that allows for the integration of various security engines, alongside content trust mechanisms that enforce digital signatures to ensure image authenticity. To support distributed infrastructure, it includes a cross-instance replication controller that synchronizes artifacts across geographic locations, ensuring high availability and disaster recovery.
Harbor manages access and organization through project-based workspaces, where granular role-based access control is enforced for users and groups. It integrates with external identity providers using standardized protocols like OIDC to streamline authentication. The system also provides comprehensive administrative capabilities, including audit logging, storage quota enforcement, and automated garbage collection to maintain registry health and performance.
The platform is built on a modular, microservices-based architecture that supports pluggable storage backends, allowing for flexibility across different cloud and local storage environments. It is designed for deployment within Kubernetes clusters, utilizing administrative APIs to facilitate programmatic management and integration with external CI/CD pipelines.
Features
- Container Image Registries - Hosts and organizes container images and cloud-native artifacts in a centralized, secure repository.
- Artifact Hosting - Hosts container images and cloud-native artifacts in a centralized, secure repository for production environments.
- Kubernetes Deployment - Provides orchestration for installing registry services within Kubernetes clusters using package management tools.
- Registry Replication - Automates the synchronization of container images across geographically distributed registry instances to ensure high availability.
- Automated Artifact Lifecycle - Manages the full lifecycle of container artifacts, including creation, security scanning, and digital signing.
- Container Security - Enforces container security through vulnerability scanning and digital signature verification for image authenticity.
- Container Security - Performs automated vulnerability scanning and enforces image integrity through content signing and authenticity verification.
- Role-Based Access Control - Enforces granular security by evaluating user permissions against project-level policies for all registry operations.
- Vulnerability Scanning - Integrates modular security engines to perform automated vulnerability scanning on container images.
- Storage Drivers - Implements pluggable storage drivers to support diverse local and cloud-based object storage backends.
- Administrative APIs - Provides RESTful interfaces for programmatic management of registry resources and infrastructure configurations.
- Artifact Repositories - Acts as a centralized storage solution for container images that integrates with Kubernetes to manage software lifecycles.
- Artifact Distribution - Synchronizes container images between local and remote storage locations to ensure consistent artifact availability.
- Multi-Site Replication - Synchronizes container images across multiple geographic locations to ensure high availability and disaster recovery.
- Registry Management - Provides centralized management of registry settings and administrative policies to maintain system health.
- Enterprise Identity Providers - Integrates with enterprise identity providers using OIDC to manage role-based access control for registry users.
- OIDC Authentication Plugins - Delegates user authentication to external identity providers using the OpenID Connect protocol.
- Project Organization - Groups container images into isolated, project-based workspaces with dedicated access controls and lifecycle rules.
- Container Registries - Trusted cloud-native registry with scanning and replication.
- Storage Management - Trusted registry for storing and scanning container images.
- Cloud Native Infrastructure - Enterprise-grade OCI registry with permission and audit features.
- Container Security - Trusted cloud-native container registry.
- DevOps and Infrastructure - Trusted cloud-native registry for containers.
- Relational Metadata Storage - Uses relational database schemas to maintain consistent storage of artifact manifests, permissions, and audit logs.
- Webhook Notifications - Delivers automated event-driven updates to external services via webhooks when artifact statuses change.
- Retention Policies - Automates the removal of outdated or unused artifact tags based on configurable retention policies.
- Automated Garbage Collection - Reclaims storage space by automatically identifying and removing unreferenced data blobs and orphaned manifests.
- Content Trust Mechanisms - Signs container images to guarantee origin and enforces policies preventing the deployment of unsigned artifacts.
- Authentication and Authorization - Validates user identity through local or external databases to secure registry operations and data.
- OIDC Identity Integrations - Supports secure authentication by integrating with external identity providers using OIDC protocols.
- Webhook Event Notifications - Triggers asynchronous callbacks to external services upon artifact lifecycle events to facilitate CI/CD pipeline integration.
- Governance Policies - Manages access controls, storage quotas, and audit logs for container artifacts within a cluster-based delivery pipeline.
- Audit Logs - Tracks and records all repository activities to provide a comprehensive history for security and compliance.
- Microservices Architectures - Decomposes registry functions into independent, containerized services to ensure modularity and scalability.
- Project Quotas - Monitors and validates project storage usage to ensure uploads do not exceed defined capacity limits.
