Harbor

Harbor wraps the open-source Distribution registry, which stores images and handles docker push and docker pull, with the services a team needs around it. An Nginx proxy routes requests to the web portal, the registry or Harbor Core, which provides the API, authentication, projects, quotas, replication and scanning. When a Docker client logs in or pushes, the registry sends it to Core’s token service, which checks the user against PostgreSQL or LDAP/AD and issues a signed token. A Job Service runs background work such as scans and replication, with Redis for caching and job metadata. Since Harbor 2.0 it stores OCI artifacts such as Helm charts as well as images.

Images live in projects, each with its own members, roles and policies. A proxy cache project stands in front of Docker Hub, another Harbor, ECR, ACR, Google’s registry, Quay, GitHub Container Registry or Artifactory: clients pull <harbor>/<project>/<image>, Harbor fetches and stores the image on a miss, and on later pulls checks the upstream manifest and serves the cached copy if nothing changed or if upstream is unreachable. You can’t push to a proxy cache project, and it gets a 7-day tag retention policy by default.

Tag retention rules are retain rules: you say which artifacts to keep, such as the 10 most recently pushed or those pulled in the last 30 days, filtered by repository and tag patterns, and everything else is discarded. Scanning goes through pluggable adapters such as Trivy, and a project can require that every artifact is signed with Cosign or Notation before it can be pulled. Replication copies images to and from other Harbor instances and registries such as Docker Hub, ECR, ACR, Artifactory, Quay and GitLab.