Harbor: A Private, Secure Artifact Registry

WHY IT EXISTS: Public registries like Docker Hub are great for public images, but enterprises need control over their software supply chain. They must secure artifacts, scan for vulnerabilities, and manage access in a private, auditable environment. Harbor was created to provide this private, secure repository for cloud-native artifacts.

THE MENTAL MODEL: Think of Harbor as a private, fortified library for your container images and Helm charts. Unlike a public library (like Docker Hub), you control who gets a library card (role-based access control), check every book for defects (vulnerability scanning), and apply an official stamp of approval (content signing).

HOW IT WORKS: Harbor runs as a service, typically on Kubernetes or a machine with Docker. You push and pull images to it just like any other registry, e.g., docker push myharbor.corp.com/myproject/myimage:latest. Under the hood, it integrates security scanners, a notary service for signing, and access control systems to enforce policies on every artifact. It supports multi-tenancy through "projects," which are isolated namespaces with their own users, permissions, and policies.

WHEN TO USE IT: Use Harbor when you need a central, private registry for your organization. It's critical for regulated industries or any environment where you must enforce security policies, scan for vulnerabilities before deployment, and ensure only trusted, signed images run in production Kubernetes clusters. It also excels at replicating images between data centers or cloud regions.

WHEN NOT TO USE IT: For small, personal projects or open-source work where private hosting and strict security policies are not concerns, a public registry is simpler. If you're already using a managed cloud provider registry (like AWS ECR, Google GCR, or Azure ACR) and its built-in features meet all your security and compliance needs, managing a separate Harbor instance might be redundant overhead.

ONE CANONICAL EXAMPLE: A financial services company uses Harbor to manage its container images. Developers push images to a "dev" project. A CI/CD pipeline triggers Harbor to scan the image for critical vulnerabilities. If it passes, the image is promoted, signed as trusted, and replicated to a "prod" project. Kubernetes clusters are configured to only pull signed images from this "prod" project, ensuring a secure software supply chain from code to production.