Skip to content
Back to Cloud Services

Harbor: self-hosted registry with vulnerability scanning

Run a private, on-prem container registry with Trivy scanning, replication, and OIDC auth.

Docker HostingAdvanced

Why

Harbor gives you a registry behind your firewall with built-in Trivy scanning, image signing (Notary v2), replication to other registries, and OIDC/LDAP auth — critical for air-gapped or regulated environments where cloud registries can't reach. Docker is used by 59% of professional developers per the Stack Overflow 2024 survey.

Docker Hub has 15M+ public images, and OCI image spec adoption means containers run identically across Docker, Podman, and containerd.

When

Use for on-prem Kubernetes, air-gapped environments, or when policy mandates self-hosted artifact storage with scanning. Avoid Docker Desktop for production (license requires paid plan for 250+ employees) — use containerd or Podman.

Skip Docker for single-binary Go/Rust apps — a static binary + systemd is simpler.

How

1. Install with the official Helm chart: `helm install harbor harbor/harbor -f values.yaml` exposing via Ingress with TLS. 2. Configure OIDC (Keycloak, Okta) under Configuration → Authentication. 3. Enable Trivy as the default scanner. 4. Set replication rules to push to a DR Harbor or pull from upstream Docker Hub for air-gap mirroring. 5. Create projects with retention policies (keep last 10). 6. Push with `docker login harbor.corp.com` then `docker push harbor.corp.com/project/app:tag`.

Example

// docker-harbor — configuration example const config = { provider: "docker" }; # values.yaml (excerpt) expose: type: ingress tls: enabled: true certSource: secret secret: secretName: harbor-tls externalURL: https://harbor.corp.com harborVersion: "2.10" trivy: enabled: true severity: "HIGH,CRITICAL" # Install helm repo add harbor https://helm.goharbor.io helm install harbor harbor/harbor -f values.yaml -n harbor

Common Problems

  • ⚠Harbor behind a self-signed cert breaks docker login — install the CA on all Docker daemons or use a public CA.
  • ⚠Trivy DB updates fail in air-gap — pre-download the DB and mount it, or use an offline scanner.
  • ⚠Storage fills up without retention policies — set per-project retention to keep last N tagged images.

Best Practices

  • ✓Use OIDC (Keycloak) instead of local DB auth so offboarding disables access automatically.
  • ✓Set replication to a DR Harbor in another datacenter for disaster recovery.
  • ✓Block deploy on CRITICAL findings via a webhook to your CI that checks the scan result.

FAQ

What is Harbor: self-hosted registry with vulnerability scanning and what problem does it solve?

Run a private, on-prem container registry with Trivy scanning, replication, and OIDC auth. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with Harbor: self-hosted registry with vulnerability scanning in 5 minutes?

Two steps to run it: (1) Install with the official Helm chart: `helm install harbor harbor/harbor -f values.yaml` exposing via Ingress with TLS.; (2) Configure OIDC (Keycloak, Okta) under Configuration → Authentication.. Validate on the free tier first, then wire into production.

What is the #1 pitfall with Harbor: self-hosted registry with vulnerability scanning?

The most frequent issue is: Harbor behind a self-signed cert breaks docker login — install the CA on all Docker daemons or use a public CA.. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for Harbor: self-hosted registry with vulnerability scanning?

Best practices for Harbor: self-hosted registry with vulnerability scanning include: Use OIDC (Keycloak) instead of local DB auth so offboarding disables access automatically.; Set replication to a DR Harbor in another datacenter for disaster recovery.; Block deploy on CRITICAL findings via a webhook to your CI that checks the scan result.. The first one — "Use OIDC (Keycloak) instead of local DB auth so offboarding disables access automatically." — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with Harbor: self-hosted registry with vulnerability scanning?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most Harbor: self-hosted registry with vulnerability scanning options offer a free tier — validate within free quota before scaling.