Harbor

Harbor is a CNCF-graduated open-source container registry that stores, signs, and scans container images and Helm charts. If you are running Kubernetes in production and pulling images from Docker Hub, Harbor gives you a private, self-hosted registry with the security controls Docker Hub does not provide.

The security features are the main reason teams choose Harbor over running a basic registry. Vulnerability scanning integrates with Trivy or Clair to analyze image layers on push, and you can configure policies to prevent deployment of images that exceed a severity threshold. Image signing with Docker Content Trust (Notary) adds a verification layer so you know an image has not been tampered with between build and deployment.

Role-based access control through project namespaces lets you give different teams access to different repositories without sharing credentials. LDAP, Active Directory, and OIDC authentication mean Harbor plugs into your existing identity infrastructure. Registry replication handles syncing images across multiple Harbor instances in different regions.

Harbor is Apache 2.0-licensed with 28,000+ GitHub stars. Deployment uses Docker Compose for single-node installs and Helm charts for Kubernetes environments. An online demo is available at demo.goharbor.io if you want to evaluate the UI before setting it up.

For any team running a container-based production workload, Harbor closes the gap between needing a private registry and being willing to trust a public one with your proprietary images.