Building a Multitenant Docker Registry Wigh Harbor

In today 's containerized measuring multiple Docker images securely and efficiently is crucial for organizations of all sizes. As enterprises scale their container deployments, thee need for a robutt, security, and difficure- rich container registry becomes paramount. Harbor, a CNCF graducated project with over 30,000 GitHub stars, is thee moste widelle adopted open- source cones nativer registry. Thi conclusive guidee walkyou threphp builg a multir registry with harbor, coverthing ething everthintim instaltion tlais configurances.

Co to jest Harbor i Why Choose It?

Harbor is an open source registry that secures artifacts witch policies and role- based accords control, ensures images are scanned ande free from hlendabilities, and signs images as trusted. Harbor extends the open source Docker Distribution by adding the functionalities usually execud by users such as security, identity andd management.

VMware open- sourced Harbor in 2016, it joind thee CNCF graduate in July 2018, and it graduated in June 2020 - making it thee first open- source registry to reach CNCF graduated status. This stoneone reflects both its maturity and thee metth of its community support.

Key Features That Set Harbor Apart

Harbor differentishes itself from basic Docker registries and even commercial distribugh several enterprise-grade capabilities:

When to Choose Harbor Over Alternatives

Organizacja run Harbor, kiedy ich potrzebują prywatne content registry with security controls that hosted registries charge for or simple do note offer, with air- gapped environments, regulated industries, and multi- cloud setups being typical use cases.

Compared to Docker Hub, Harbor offers built- in levibility scanning, image signing, RBAC, audit logging, and multi- registry y replication - factures that require Docker Hub paid plans or are unacceptable. For organizations with data residency requirements, compleance mandates, or the need for unlimited private reprisitoriae, Harbor providees a comelling selling selhosted explitiva.

Understanding Harbor 's Multi- tenancy Architecture

Before diving into installation, it 's essential to understand how Harbor implements multi- tenancy and how this architecture supports organizational isolation and security.

Projekts as Tenant Boundaries

Artists within Harbor ar e owned a project, andthis grouping allows settings ond permissions to o be tuned for sets of artifacts as opposet to a purely global level. Projects servade as the fundamentaltal unit of multi- tenancy in Harbor, acting as isolated namespaces that separate acteer images, Helm charts, and cor OCI artifacts by team, departt, or moveromer.

Harbor 's multi- tenancy capabilities included projects acting as namespaces that isolate models by y team, environment, or use case, alongwich fine- grained RBAC for controling who can push, pull, or administrator artifacts. Thi project- based isolation ensures that different tenants cannot t actes each cor' s artifacts with out explayat permissionon grants.

Role- Based Access Control (RBAC)

Users accords different repositories through gh; projects presents; and a user can have different permission for images or Helm charts under a project. Harbor implements a experimentate RBAC system with predefined role that can be assigned at thee project level:

This granular permissionon model allows organisations to implement the principle of least presence, ensuring users andd automated systems only have acceptes to thee resources they need.

Autentiation Integration

In the simpleset cases, users can by created by Harbor itself andd managed internally, however, this doesn 't scale specilarly well, so Harbor also provides integration intro tell popular services such as OIDC, Active Directory, andd LDAP. Thies elastyczny bility alls alls organisations to leverage existing identity management infrastructure, reducting administrative overhead and ensuring concentrance concentrals contations policies across systems.

Warunki wstępne i systemowe

Before installing Harbor, ensure your environment meets thee necessary requirements for a production- ready deployment.

Środki

For a production Harbor deployment supporting multiple tenants, consider the following minimum specifications:

Software Prerequisites

Harbor wymaga, aby te subskrypcje były następujące:

Network and Domain Configuration

For a production deployment, you 'll need:

Installing Harbor: Step- by- Step Guide

Harbor can by installad on any Kubernetes environment or on a system with Docker support. This guides covers both installation methods, startin with the Docker Compose approvach for simplicity, followed by Kubernetes deployment using Helm charts.

Method 1: Installing Harbor wigh Docker Compose

Docker Compose provides the quickest path to getting Harbor up and running, making it ideal for developments and smaller deployments.

Krok 1: Install Docker and Docker Compose

First, ensure Docker and Docker Compose are installald on your system. On Ubuntu, you can install them with the following Commands:

# Update package index
sudo apt update

# Install prerequisites
sudo apt install -y ca-certificates curl gnupg lsb-release

# Add Docker's official GPG key
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg

# Set up Docker repository
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Install Docker Engine and Docker Compose
sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

# Start and enable Docker
sudo systemctl start docker
sudo systemctl enable docker

# Verify installation
docker --version
docker compose version

Step 2: Download Harbor

Download binaries of Harbor release and follow Installation demmp; amp; Configuration Guidee to install Harbor. You can download thee latest Harbor release from the official GitHub repository:

# Download the latest Harbor release
cd /opt
curl -s https://api.github.com/repos/goharbor/harbor/releases/latest | grep browser_download_url | cut -d '"' -f 4 | grep '.tgz$' | wget -i -

# Extract the archive
tar xzvf harbor-offline-installer-*.tgz

# Navigate to Harbor directory
cd harbor

Krok 3: Konfiguracja Harbor

Harbor używa konfiguratora YAML file that mutt be customized for your environment:

# Copy the template configuration file
cp harbor.yml.tmpl harbor.yml

# Edit the configuration file
nano harbor.yml

Key configuation parameters to modify:

# The hostname or IP address of your Harbor server
hostname: harbor.yourdomain.com

# HTTP configuration
http:
 port: 80

# HTTPS configuration (recommended for production)
https:
 port: 443
 certificate: /path/to/your/certificate.crt
 private_key: /path/to/your/private_key.key

# Harbor admin password (change this!)
harbor_admin_password: YourSecurePassword123!

# Database configuration
database:
 password: DatabasePassword123!
 max_idle_conns: 100
 max_open_conns: 900

# Data storage location
data_volume: /data

# Log configuration
log:
 level: info
 local:
 rotate_count: 50
 rotate_size: 200M
 location: /var/log/harbor

Step 4: Generate SSL Certificates (Optional but Recommended)

For production deployments, use CA- signed certificates. For testing, you can generate sel- signed certificates:

# Create certificate directory
mkdir -p /opt/harbor/certs
cd /opt/harbor/certs

# Generate private key
openssl genrsa -out harbor.key 4096

# Generate certificate signing request
openssl req -new -key harbor.key -out harbor.csr -subj "/C=US/ST=State/L=City/O=Organization/CN=harbor.yourdomain.com"

# Generate self-signed certificate (valid for 365 days)
openssl x509 -req -days 365 -in harbor.csr -signkey harbor.key -out harbor.crt

# Update harbor.yml with certificate paths
# certificate: /opt/harbor/certs/harbor.crt
# private_key: /opt/harbor/certs/harbor.key

Krok 5: Install Harbor wigh Trivy Scanner

Trivy is the default scanner Since Harbor v2.2. To install Harbor with the Trivy shierability scanner enenabled:

# Run the installation script with Trivy
sudo ./install.sh --with-trivy

# Verify all containers are running
docker compose ps

Powinieneś być taki jak wyrzutnia showing all Harbor services running, including harbor- core, harbor- portal, harbor- db, registry, trivy- adapter, and other.

Step 6: Access Harbor Web Interface

Once thee installation is complete, you should be able to accessions the Harbor UI in your web browser at https: / / harbor.yourdomain.com and log in with the adomin user and thee pasword you set.

Method 2: Installing Harbor on Kubernetes wigh Helm

If you want to deploy Harbor on Kubernetes, please use the Harbor chart. Kubernetes deployment offers better scalability, high acvasibility, and integration with cloud- nativa ecosystems.

Step 1: Add Harbor Helm Reposity

# Add Harbor Helm repository
helm repo add harbor https://helm.goharbor.io

# Update Helm repositories
helm repo update

# Create namespace for Harbor
kubectl create namespace harbor

Krok 2: Stworzenie Helm Values File

Stwórz wartość powiernika dla pliku konfiguracyjnego:

cat > harbor-values.yaml <<EOF
expose:
 type: ingress
 tls:
 enabled: true
 certSource: secret
 secret:
 secretName: harbor-tls
 ingress:
 hosts:
 core: harbor.yourdomain.com
 className: nginx
 annotations:
 cert-manager.io/cluster-issuer: "letsencrypt-prod"

externalURL: https://harbor.yourdomain.com

persistence:
 enabled: true
 resourcePolicy: "keep"
 persistentVolumeClaim:
 registry:
 storageClass: "fast-ssd"
 size: 500Gi
 database:
 storageClass: "fast-ssd"
 size: 10Gi
 redis:
 storageClass: "fast-ssd"
 size: 1Gi

harborAdminPassword: "ChangeThisPassword123!"

database:
 type: internal

redis:
 type: internal

trivy:
 enabled: true

notary:
 enabled: true
EOF

Krok 3: Install Harbor via Helm

# Install Harbor
helm install harbor harbor/harbor
 -n harbor
 -f harbor-values.yaml

# Wait for all components to be ready
kubectl wait --for=condition=available --timeout=600s
 deployment --all -n harbor

# Check pod status
kubectl get pods -n harbor

# Get Harbor admin password
kubectl get secret harbor-core -n harbor -o jsonpath='{.data.HARBOR_ADMIN_PASSWORD}' | base64 -d

Konfiguracja Multi- tenancy in Harbor

With Harbor installalod, the next step is configuring multitenancy to o support multiple teams, departments, or customers with in your organization.

Projekts for Tenants

You can create multiple projects in Harbor to separate thee artifacts stored by y different teams or sub- organisations with in enterprise. Projects can be created them Harbor web interface or programmatically via thee API.

Projekts Creating via Web Interface

To create a project thugh the Harbor portal:

  1. Log in to Harbor as an administrator
  2. Click on quenticut; Projects quenticuit; in the left navigation menu
  3. Klikając ten cytat; NEW PROJECT notification quote; button
  4. Konfiguracja tych projektów ustawia się: Xi1; Xi1; FLT: 0 Xi3; Xi3; Xi1; FLT: 1 Xi3; Xi3; Xi1; Xi1; FLT: 2 Xi3; Xi3; FLT: Xi1; Xi1; FLT: Xi3; Xi3; FLT: 3 XiVe; XiVe; FLT: 1 XiVe 3; XiVe 3; XiVe; XiVe; XiViViVe; XiViVe: XiViVe; FLT: 3; XiViViVe; FLT: 1; XiViViViViViViVe; USe a XiViViVe; Fe; XiViViVe; Fe XiViVe Xe Xe; Xe; XiVEYYVEYYYYYYYYYYYYYYY@@
  5. Xi1; Xi1; FLT: 0 Xi3; Xi3; Access Level: Xi1; Xi1; FLT: 1 Xi3; Xi3; Xi3; Xion3; Xion3; Xion3; FLT: 1 Xion3; Xion3; Xion3; Xion3; Xion3; Xion3; Xion3; Xion3; Xion3; Xion3c; XionQuionQuiont; (anyone can pull) or Xionquit; Private Xionquite; (wymagane uwierzytelniony)
  6. Xi1; Xi1; FLT: 0 Xi3; Xi3; Storage Quota: Xi1; Xi1; FLT: 1 Xi3; Xi3; Set a limit to prevent any single tenant frem consuming excessive storage
  7. Proxy Cache: Proxy 1; FLT: 1 Prox3; Proxy3; FLT: 1 Prox3; Proxy3; Optionally configue thee project as a proxy cache for external registries
  8. Klikając kwotowanie; OK kwotowanie; to kreate the project

Projekts Creating via API

For automate project creation or bulk operations, use thee Harbor REST API:

# Set Harbor credentials
HARBOR_URL="https://harbor.yourdomain.com"
HARBOR_USER="admin"
HARBOR_PASSWORD="YourSecurePassword123!"

# Create multiple projects
for project in team-frontend team-backend team-ml customer-alpha customer-beta; do
 curl -X POST "${HARBOR_URL}/api/v2.0/projects"
 -H "Content-Type: application/json"
 -u "${HARBOR_USER}:${HARBOR_PASSWORD}"
 -d "{
 "project_name": "${project}",
 "public": false,
 "storage_limit": 107374182400
 }"
 echo "Created project: $project"
done

# List all projects
curl -X GET "${HARBOR_URL}/api/v2.0/projects"
 -u "${HARBOR_USER}:${HARBOR_PASSWORD}" | jq .

Konfiguracja Project- Level Settings

Each project in Harbor can be configured independently with settings that enforcee security policies and resource limits.

Kwoty storagowe

Storage quotas prevent individual tenants frem consuming excessive disk space:

  1. Nawigate to thee project
  2. Click on quentiquent; Configuration quentiquent; tab
  3. Under quantitage; Resource Management, quantitation; set the storage quota. (np., 100 GB)
  4. Click quentiquent; Save quentiquentit;

Vulnerability Scanning Policies

Konfiguracja automatic shindability scanning for images pushed to thee project:

  1. Go toproject quentiquent; Configuration quentiquent;
  2. Enable quantiquative; Automatically scan images on push quantiquative;
  3. Set quentiquent; Prevent shengable images from running quentiquent; to block images with critial shendabilities
  4. Configure sevity bloold (np., block images with quenquentit; High quentiquentit; or quentical quentique; hlendabilities)

Tag Retention Policies

Retention policies automatically clean up old or unused images to manage togue efficiently:

  1. Navigate to project quenquent; Policy quenquenquent; tab
  2. Click quentious; Add Rule quentiquote; Under Tag Retention
  3. Konfiguracja retention criteria: vir1; vir1; FLT: 0 vir3; vir3; vir1; vil3; FLT: 1 vir3; vir3; Repository matching pattern (np., vilquent; * * virgionquent; for all repositories)
  4. Retention rule (np., quantiquite; setail the most recently pushed 10 artifacts quantiquatiquit;)
  5. Tag matching Pattern (np., contexte context quentit; latess context context; and context quentiquent; production context; tags)
  6. Click quentice; Add quentiquentit; and then quentiquentit; Run Nowa quentiquentit; to tect the policy

Content Truss andd Image Signing

Enable content truss to ensure only signed images can be pulled:

  1. In project quentiquent; Configuration, quentiquent; enable quentiquente; Enable content truss quention;
  2. This requires images tos be signed using Docker Content Truss or Cosign
  3. Unsigned images will be rejected when user is contact to pull them

Managing User Access andPermissions

Effective multi- tenancy requires carefult management of user accesss and permissions to ensure tentants can only accesss their ir designated resources.

User Management Strategies

Harbor wspiera wiele weryfikacji autentyczności, pozwala na to, aby twoja technologia była zgodna z tym, co jest niezbędne do organizacji.

Local User Management

For small deployments or testing, you can create users directly in Harbor:

  1. Log in as adiun
  2. Navigate to quentiquent; Administration quentiquent; → quentiquent; Users quentiquent;
  3. Klikając kwotowanie; NEW USER kwotowanie;
  4. Fill in user detals (username, email, full name, password)
  5. Click quenquent; OK quenquenteit;

LDAP / Active Directory Integration

For enterprise deployments, integrate Harbor wigh your existing LDAP or Active Directory:

  1. Navigate to quentiquent; Administration quentiquent; → quentiquentioon quentiquentionate; → quenticulation quenticuit;
  2. Select quentiote; LDAP quentiquentiquot; as the authentiation mode
  3. Konfiguracja: 1; V.1.1.; FLT: 0 X.3; V.1.3.; FLT: 1 X.3; FLT: 1 X.3; V.1.1.; FLT: 2 X.3; V.3; LDAP URL: V.1; FLT: 3 X.3; V.3; Idap: / / ldap.yourdomain.com: 389
  4. Xi1; Xi1; FLT: 0 Xi3; Xi3; LDAP Search DN: Xi1; FLT: 1 Xi3; Xi3; cn = adiunn, dc = your dombayn, dc = com
  5. Xi1; Xi1; FLT: 0 Xi3; Xi3; LDAP Base DN: Xi1; FLT: 1 Xi3; Xi3; dc = your domayn, dc = com
  6. Xi1; Xi1; FLT: 0 Xi3; Xi3; LDAP Filter: Xi1; Xi1; FLT: 1 Xi3; Xi3; (objectClass = person)
  7. Xi1; Xi1; FLT: 0 Xi3; Xi3; LDAP UID: Xi1; Xi1; FLT: 1 Xi3; Xi3; uid
  8. Xi1; Xi1; FLT: 0 Xi3; Xi3; LDAP Scope: Xi1; Xi1; FLT: 1 Xi3; Xi3; Subtree
  9. Teszt thee connection
  10. Click quentiquent; Save quentiquentit;

OIDC Integration

For modern identity providers like Okta, Auth0, or Keycloak:

  1. In notification quentionation quentiques; settings, select quentionary; OIDC quentiquentionary;
  2. Parametry OIDC konfiguracyjne: Xi1; Xi1; FLT: 0 Xi3; Xi3; Xi1; FLT: 1 Xi3; Xi3; Xi1; FLT: 2 Xi3; Xi3; Xi3; Xi3; Xi3; Xi1XIDC Provider Name: Xi1; FLT: 3 Xi3; Xi3; Xi3; Your provider name
  3. Xi1; Xi1; FLT: 0 Xi3; Xi3; OIDC Endpoint: Xi1; Xi1; FLT: 1 Xi3; Xi3; https: / / your- idp.com
  4. Xi1; Xi1; FLT: 0 Xi3; Xi3; OIDC Client ID: Xi1; Xi1; FLT: 1 Xi3; Xi3; Xi3; XiUr client ID
  5. Xi1; Xi1; FLT: 0 Xi3; Xi3; OIDC Client Secret: Xi1; Xi1; FLT: 1 Xi3; Xi3; XiUR client secret
  6. Xi1; Xi1; FLT: 0 Xi3; Xi3; OIDC Scope: Xi1; Xi1; FLT: 1 Xi3; Xi3; openid, profile, email
  7. Verify andd save

Assigning Users to Projects

Once users are authenticated, assign them to projects with appropriate role:

  1. Nawigate to thee project
  2. Click on quentiquent; Members quentiquent; tab
  3. Click metriquentes; USER metriculars; or metriquentes; GROUP metriquentes; to add members
  4. Search for thee user or group
  5. Select thee appropriate role: oda1; Douglas 1; FLT: 0 Province3; Douglas 3; Sex1; FLT: 1 Province3; Duferned 3; Dufernee 1; FLT: 2 Propertee 3; Duferned 3; Gueszt: Description: 3 Propert3; Duferned 3; Read- only Accuses to pull images
  6. Xi1; Xi1; FLT: 0 Xi3; Xi3; Developer: Xi1; Xi1; FLT: 1 Xi3; Xi3; Can push andd pull images
  7. Xi1; Xi1; FLT: 0 Xi3; Xi3; Keytainer: Xi1; FLT: 1 Xi3; Xi3; Can manage project members andd configures settings
  8. Progress: 1; Progress: 1 Progress: 1 Progress: 1 Progress; Progress: 0 Progress: 3; Progress: 3; Progress: 1 Progress; Progress: 1 Progress: 1 Progress; Progress: 0 Progress: 0 Progress 3; Progress: Progress 3; Progress: 1 Progress: 1 Progress: 1 Progress: 1 Progress: 1 Progress: 1 Progress: 1 Progress: 1 Progress: 1 Progress: 1; FLT: 0 Progress: 0 Progress: 0 Progress: 3; Progress: 3; Progress: 3; Progress: 3; Progress: Project: Project: Project: 1; Progress: Project: Project: Project: Project: Project: Project: Project: Project: Project: Project: Project: Project: Project: Project: Project: Project: Project: Project: Project: Proje@@
  9. Click quenquent; OK quenquenteit;

Robot Accounts for CI / CD Integration

Robot accounts are e service accounts in Harbor witch specific permissions, used d for automated operations like CI / CD concluines pushing or pulling images without out requiring human creditials.

To create a robot account:

  1. Nawigate to thee project
  2. Click quantiquative; Robot Accounts quantiquation; tab
  3. Kwit kwotowania klika; Kwit księgowy NEW ROBOT;
  4. Konfiguracja tego robota: Xi1; Xi1; FLT: 0 Xi3; Xi3; Xi1; FLT: 1 Xi3; Xi3; Xi1; FLT: 2 Xi3; Xi3; Xi3; Name: Xi1; FLT: 3 Xi3; XiPtivy name (np.
  5. Xi1; Xi1; FLT: 0 Xi3; Xi3; Expiration time: Xi1; Xi1; FLT: 1 Xi3; Xi3; Set an Xitration date for security
  6. Xi1; Xi1; FLT: 0 Xi3; Xi3; Permissions: Xi1; Xi1; FLT: 1 Xi3; Xi3; Select specific repositories andd actions (push, pull, delete)
  7. Click quentiquent; ADD quentiquentiquent;
  8. Copy the generated token instantately (it won 't be shown again)

Use thee robot account in your CI / CD Moscine:

# In your CI/CD pipeline (e.g., GitLab CI, Jenkins)
docker login harbor.yourdomain.com -u 'robot$ci-pipeline-bot' -p 'TOKEN_HERE'
docker build -t harbor.yourdomain.com/team-frontend/app:${CI_COMMIT_SHA} .
docker push harbor.yourdomain.com/team-frontend/app:${CI_COMMIT_SHA}

Security Features for Multi- tenant Environments

Security is paramount in multitenant environments where multiple teams or customers share infrastructurture. Harbor provides complessive security quantitures to protect your contexer supply chain.

Vulnerability Scanning

By utilizing popular images scanners, such as Trivy, images can be automatically scanned for known devabilities, and the e result of these scans can be leveraged to prevent pulling of artifacts with unadrexed security issues.

Konfiguracja Automatic Scanning

Umożliwia automatyczne skanning at thee system or project level:

  1. For system- wide scanning: quenciquote; Administration quenciquot; → quenciquote; Interrogation Services quenciquote; → Configure Trivy settings
  2. For project- level scanning: Project → message quent; Configuration quentiquent; → Enable quentiquent; Automatically scan images on push quentiquentit;
  3. Set up scheduled scans to re- scan existing images for newly discvered deflabilities

Vulnerability Prevention Policies

Konfiguracja policies to zapobieganie słabościom obrazów from being deployed:

  1. In project quentiquent; Configuration, quentiquent; enable quentiquente; Prevent shindable images from running quentiquent;
  2. Set they sequity browold (np., quentiquent; High quentiquentit; or quentiquentit;)
  3. Images witch lowerabilities at or above this bourold cannot t be pulled

Viewing Scan Results

Tu view shierability scan results:

  1. Nawigate to thee project andd repository
  2. Klick on an artifact / tag
  3. View thee quantitation; Vulnerabilities quantiquote; tab for detailed scan results
  4. Przegląd CVE szczegóły, poziomy selity, i dostępne mocowania

Image Signing andContent Truss

Harbor supports signing contener images using Docker Content Truss (leveraging Notary) for conteneing authentity ide provenance, and policies that prevent unsigned images frem being deployed can also be activated.

Enabling Content Truss

To enable content truss for a project:

  1. Navigate to project quentiquent; Configuration quentiquent;
  2. Enable quentiquent; Enable content truss quentiquent;
  3. Enable notification; Prevent unsigned images frem being pulled notification;

Signing Images wigh Docker Content Truss

# Enable Docker Content Trust
export DOCKER_CONTENT_TRUST=1
export DOCKER_CONTENT_TRUST_SERVER=https://harbor.yourdomain.com:4443

# Push and sign an image
docker push harbor.yourdomain.com/team-frontend/app:v1.0

# The first push will prompt you to create signing keys
# Follow the prompts to set passphrases for root and repository keys

Signing wigh Cosign

For modern signing workflows, use Cosign:

# Install Cosign
curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64"
sudo mv cosign-linux-amd64 /usr/local/bin/cosign
sudo chmod +x /usr/local/bin/cosign

# Generate key pair
cosign generate-key-pair

# Sign an image
cosign sign --key cosign.key harbor.yourdomain.com/team-frontend/app:v1.0

# Verify signature
cosign verify --key cosign.pub harbor.yourdomain.com/team-frontend/app:v1.0

Audit Logging and Compliance

All thee operations to the repositories are tracked through logs. Harbor maintains complessive audit logs that track all user activities, making it easyr to meet compleance requirements andd investigate security incidents.

Rejestry samochodów Viewing

  1. Navigate to quentiquent; Administration quentiquent; → quentiquent; Logs quentiquent;
  2. Filtr logs by: Xi1; Xi1; FLT: 0 Xi3; Xi3; Xi1; Xi1; FLT: 1 Xi3; Xi3; FLT: Xi3; Xifl3; Xifl3; Xiflf: 0 Xifl3; Xifl3; Xifl1; Xifl1; Xiflf: Xifl3; Xifl3; Xifl3; Xiflf: 0 Xifl3; Xifl3; Xifl3; Xiflf: 0 Xiflf; Xiflf; Xiflf; Xiflf; Xiflf; Xiflf; Xiflf; Xlf; Xlf; Xiflf; Xlf; Xlf; Xlf; Xlf; Xlf; Xlf; Xlf; Xlf; Xlf; Xlf; Xpf; Xp@@
  3. Operation type (push, pull, delete, create, etc.)
  4. Resource type (project, reposility, artifact)
  5. Time range
  6. Eksport logs for external analysis or archival

Integrating wigh SIEM Systems

For enterprise compleance, integrate Harbor logs with your SIEM system:

# Configure Harbor to send logs to syslog
# Edit harbor.yml
log:
 level: info
 external_endpoint:
 protocol: tcp
 host: syslog.yourdomain.com
 port: 514

# Restart Harbor to apply changes
docker compose down
docker compose up -d

Network Security andd Access Control

Konfiguracja HTTPS

Zawsze używa HTTPS in production to code pt data in transit:

  1. Obtain SSL / TLS certificates from a trusted CA (Let 's Encrypt, DigiCert, etc.)
  2. Configure harbor.yml with certificate pats
  3. Przywróć Harbor

Firewall Configuration

Ograniczenia dotyczące stosowania tych przepisów Harbor using firewall rules:

# Allow HTTPS traffic
sudo ufw allow 443/tcp

# Allow HTTP (if needed for redirect)
sudo ufw allow 80/tcp

# Allow Notary (if using Docker Content Trust)
sudo ufw allow 4443/tcp

# Restrict access to specific IP ranges (optional)
sudo ufw allow from 10.0.0.0/8 to any port 443 proto tcp

# Enable firewall
sudo ufw enable

Image Replication for Multisite Deployments

Images andd charts can by replicated (synchronized) between multiple registry instances based on policies with using filters (repository, tag andd label), and Harbor automatically retries a replication if it encounter any errors, which ch can be used te assist loadbalancing, acceve high acceptibility, and facipativalite multi- datacenter deployments in mold and multi- cloud diploud.

Setting Up Replication Endpoints

Replikation targets included teor Harbor instacans, Docker Hub, AWS ECR, Google GCR / GAR, Azure ACR, and any OCI- compleant registry.

Tu konfigurator a replication endpoint:

  1. Navigate to quentiquent; Administration quentiquent; → quentiquent; Registries quentiquent;
  2. Klikanie kwotowania; NEW ENDPOINT kwotowanie kwotowania;
  3. Konfiguracja endpoint detals: XX1; XXX1; FLT: 0 XX3; XXX3; XXX3; FLT: 1 XX3; EFX3; EFX3; EFX1; FLT: 2 XX3; EFY3; Provider: XXX3; FLT: 3 XX3; EFYD3; SEX3; SELEct TE REGRY TYPE (Harbor, Docker Hub, AWS ECR, etc.)
  4. Xiv1; Xiv1; FLT: 0 Xiv3; Xiv3; Name: Xiv1; Xiv1; FLT: 1 Xiv3; Xivy3; Xivtive name for the endpoint
  5. Xi1; Xi1; FLT: 0 Xi3; Xi3; Xi1; Xi1; FLT: 1 Xi3; Xi3; Xi3; Xir3; Xir3; Xirr; Xirr
  6. Xi1; Xi1; FLT: 0 Xi3; Xi3; Access ID / Secret: Xi1; Xi1; FLT: 1 Xi3; Xi3; Authentication credentials
  7. Teszt thee connection
  8. Click quenquent; OK quenquenteit;

Creating Replication Rules

Określ repliki policies to automatically sync images:

  1. Navigate to quentiquent; Administration quentiquent; → quentiquent; Replications quentiquent;
  2. Klikając kwotowanie; Kwintesencja NEW REPLICATION RULE;
  3. Konfiguracja tej zasady: Xi1; Xi1; FLT: 0 Xi3; Xi3; Xi1; FLT: 1 Xi3; Xi3; FLT: 1 Xi3; Xi1; FLT: 2 Xi3; Xi3; FLT: Xi1; XiPTIVE rule name
  4. Xi1; Xi1; FLT: 0 Xi3; Xi3; Replication mode: Xi1; Xi1; FLT: 1 Xi3; Xi3; Push (tu remote) or Pull (from demote)
  5. Xi1; Xi1; FLT: 0 Xi3; Xi3; Source registry: Xi1; Xi1; FLT: 1 Xi3; Xi3; Selekt source
  6. Xi1; Xi1; FLT: 0 Xi3; Xi3; Destination registry: Xi1; Xi1; FLT: 1 Xi3; Xi3; Select target endpoint
  7. Xi1; Xi1; FLT: 0 Xi3; Xi3; Trigger mode: Xi1; Xi1; FLT: 1 Xi3; Xi3; Manual, Scheduled, or Event- based
  8. Xi1; Xi1; FLT: 0 Xi3; Xi3; Filtry: Xi1; Xi1; FLT: 1 Xi3; Xi3; Specify which repositories, tags, or labels to replicate
  9. Klikanie kwotowania; Kwit kwotowania SAVE;

Usie Cases for Replication

Working wigh Harbor: Practical Workflows

Once Harbor is configured for multi- tenancy, teams can begin using it for their container workflows.

Pushing Images to Harbor

Tu push an image to Harbor:

# Log in to Harbor
docker login harbor.yourdomain.com

# Tag your image with Harbor registry path
docker tag myapp:latest harbor.yourdomain.com/team-frontend/myapp:v1.0

# Push the image
docker push harbor.yourdomain.com/team-frontend/myapp:v1.0

Pulling Images frem Harbor

# Log in to Harbor (if pulling private images)
docker login harbor.yourdomain.com

# Pull the image
docker pull harbor.yourdomain.com/team-frontend/myapp:v1.0

# Run the container
docker run -d harbor.yourdomain.com/team-frontend/myapp:v1.0

Using Harbor wigh Kubernetes

Tu pull images from Harbor in Kubernetes, create an image pull secret:

# Create a Docker registry secret
kubectl create secret docker-registry harbor-registry
 --docker-server=harbor.yourdomain.com
 --docker-username=your-username
 --docker-password=your-password
 [email protected]
 -n your-namespace

# Reference the secret in your pod spec
apiVersion: v1
kind: Pod
metadata:
 name: myapp
spec:
 containers:
 - name: myapp
 image: harbor.yourdomain.com/team-frontend/myapp:v1.0
 imagePullSecrets:
 - name: harbor-registry

Proxy Cache for External Registries

Harbor 's proxy cache fabumure allows Harbor to act as a caching proxy for external registrie, reducing bandwidth usage and improwing g pull performance.

Tu konfigurator Proxy cache project:

  1. Stworzenie nowego projektu
  2. Wybrane kwotowanie; Proxy Cache noticuit; as the project type
  3. Choose the target registry (Docker Hub, Quay.io, etc.)
  4. Konfiguracja credentials if needed
  5. Pull images thus proxy cache path Harbor using thee
# Instead of pulling from Docker Hub directly
docker pull nginx:latest

# Pull through Harbor proxy cache
docker pull harbor.yourdomain.com/dockerhub-proxy/library/nginx:latest

Backup andDisaster Recovery

Chronić ciebie Harbor deployment and it s data is critial for continuity.

Backing Up Harbor Data

Harbor używa bazy danych tego story its data, and by default, it uses a PostgreSQL datase that is managed by Docker.

Tu back up Harbor:

# Stop Harbor
cd /opt/harbor
docker compose down

# Backup the data directory
sudo tar -czf harbor-backup-$(date +%Y%m%d).tar.gz /data

# Backup the configuration
sudo cp harbor.yml harbor.yml.backup

# Backup the database (if using external database)
docker exec harbor-db pg_dump -U postgres registry > harbor-db-backup-$(date +%Y%m%d).sql

# Restart Harbor
docker compose up -d

Automated Backup Script

#!/bin/bash
# harbor-backup.sh

BACKUP_DIR="/backup/harbor"
DATE=$(date +%Y%m%d-%H%M%S)
HARBOR_DIR="/opt/harbor"
DATA_DIR="/data"

# Create backup directory
mkdir -p $BACKUP_DIR

# Stop Harbor
cd $HARBOR_DIR
docker compose down

# Backup data volume
tar -czf $BACKUP_DIR/harbor-data-$DATE.tar.gz $DATA_DIR

# Backup configuration
cp $HARBOR_DIR/harbor.yml $BACKUP_DIR/harbor-config-$DATE.yml

# Restart Harbor
docker compose up -d

# Remove backups older than 30 days
find $BACKUP_DIR -name "harbor-*" -mtime +30 -delete

echo "Backup completed: $BACKUP_DIR/harbor-data-$DATE.tar.gz"

Schedule this script with cron:

# Run backup daily at 2 AM
0 2 * * * /usr/local/bin/harbor-backup.sh >> /var/log/harbor-backup.log 2>&1

Restoring from Backup

# Stop Harbor
cd /opt/harbor
docker compose down

# Restore data directory
sudo rm -rf /data
sudo tar -xzf /backup/harbor/harbor-data-20260402.tar.gz -C /

# Restore configuration
sudo cp /backup/harbor/harbor-config-20260402.yml /opt/harbor/harbor.yml

# Restart Harbor
docker compose up -d

Monitoring andPerformance Optimization

Monitoring Harbor 's health and performance ensure optimal operation and helps identify issues bee for they impact users.

Monitoring Harbor Health

Harbor exposes health check endpoints:

# Check Harbor health
curl -k https://harbor.yourdomain.com/api/v2.0/health

# Expected response
{
 "status": "healthy",
 "components": [
 {"name": "core", "status": "healthy"},
 {"name": "database", "status": "healthy"},
 {"name": "redis", "status": "healthy"},
 {"name": "registry", "status": "healthy"}
 ]
}

Prometeus Metrics

Harbor exposes Prometheus metrics for monitoring:

# Enable metrics in harbor.yml
metric:
 enabled: true
 port: 9090
 path: /metrics

# Scrape metrics with Prometheus
curl http://harbor.yourdomain.com:9090/metrics

Optymalizacja wydajności Tips

Garbage Collection

Garbage collection is the process of recoveriming storage space by removing unreferenced blobs and artifacts that are no longer needed.

To run garbage collection:

  1. Navigate to quentiquent; Administration quentiquent; → quentiquote; Garbage Collection quentiquotin;
  2. Click quantiquationQuentin; GC NOW Quentiquotint; for instante collection
  3. Or schedule regular garbage collection (np., weekly at 2 AM)

Rozwiązywanie problemów Common Emites

Cannot Push Images

Xi1; Xi1; FLT: 0 Xi3; Xi3; Xi3; Xi1; FLT: 1 Xi3; Xi3; Xionquit; denied: requested acquis to the resource e s denied Xionquit; error

Xi1; Xi1; FLT: 0 Xi3; Xi3; Solutions: Xi1; Xi1; FLT: 1 Xi3; Xi3;

SSL Certificate Errors

Xi1; Xi1; FLT: 0 Xi3; Xi3; XiM3; XiM1; FLT: 1 XiM3; XiM3; XiMQuent; x509: certificate signed by nieznany autorytowy Quantity; error

Xi1; Xi1; FLT: 0 Xi3; Xi3; Solutions: Xi1; Xi1; FLT: 1 Xi3; Xi3;

Nonsens image Push / Pull

Xi1; Xi1; FLT: 0 Xi3; Xi3; XiMTOMS: XiM1; XiM1; FLT: 1 XiM3; XiM3; Image operations take excessive time

Xi1; Xi1; FLT: 0 Xi3; Xi3; Solutions: Xi1; Xi1; FLT: 1 Xi3; Xi3;

Baza danych Connection Emites

Xi1; Xi1; FLT: 0 Xi3; Xi3; XiM3: XiM1; FLT: 1 XiM3; XiM3; Harbor UI shows errors or won 't load

Xi1; Xi1; FLT: 0 Xi3; Xi3; Solutions: Xi1; Xi1; FLT: 1 Xi3; Xi3;

Advanced Multi- tenacy Scenarios

Customer- Facing Container Distribution

Harbor can be used to difficee containerized competitiare to external customers:

Multi- Region Deployment

For global organizations, deploy Harbor in multiple regions:

Compliance andRegulatory Requirements

For regulated industries (healthcare, finance, government):

Begt Practices for Multi- tenant Harbor Deployments

Security Bett Practices

Operacjal Beszt Practices

Organizacja Bess Practices

Integrating Harbor wigh Your DevOps Ecosystem

CI / CD Pipeline Integration

Example GitLab CI Portuguina:

stages:
 - build
 - scan
 - deploy

variables:
 HARBOR_REGISTRY: harbor.yourdomain.com
 HARBOR_PROJECT: team-frontend
 IMAGE_NAME: myapp

build:
 stage: build
 script:
 - docker login -u robot$ci-bot -p $HARBOR_TOKEN $HARBOR_REGISTRY
 - docker build -t $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_SHA .
 - docker push $HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_SHA

scan:
 stage: scan
 script:
 - |
 # Wait for Harbor to scan the image
 sleep 30
 # Check scan results via Harbor API
 SCAN_STATUS=$(curl -u robot$ci-bot:$HARBOR_TOKEN
 "$HARBOR_REGISTRY/api/v2.0/projects/$HARBOR_PROJECT/repositories/$IMAGE_NAME/artifacts/$CI_COMMIT_SHA"
 | jq -r '.scan_overview.scan_status')
 if [ "$SCAN_STATUS" != "Success" ]; then
 echo "Vulnerability scan failed"
 exit 1
 fi

deploy:
 stage: deploy
 script:
 - kubectl set image deployment/myapp myapp=$HARBOR_REGISTRY/$HARBOR_PROJECT/$IMAGE_NAME:$CI_COMMIT_SHA
 only:
 - main

Webhook Integration

Konfiguracja webhooks to trigger actions when images are pushed:

  1. Navigate to project quentiquit; Webhooks quentiquentit;
  2. Klikając w kwotowaniu; NEW WEBHOOK w kwotowaniu;
  3. Konfiguracja webhook: Xi1; Xi1; FLT: 0 Xi3; Xi3; Xi1; Xi1; FLT: 1 Xi3; Xi3; Xi1; FLT: 2 Xi3; Xi3; FLT: Xi1; FLT: 3 Xi3; Xi3; Xi3; Xi3; XYR webhook receiver URL
  4. Xi1; Xi1; FLT: 0 Xi3; Xi3; Events: Xi1; Xi1; FLT: 1 Xi3; Xi3; Select events to trigger (push, pull, delete, scan completed)
  5. Xiv1; Xiv1; FLT: 0 Xiv3; Xiv3; Authentication: Xiv1; Xiv1; FLT: 1 Xiv3; Xiv3; Xivyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvyvy1; X3; X3; X333; X3; Xvivy@@
  6. Teszt thee webhook
  7. Klikając kwotowanie; KWALIFIKUJĄCE kwotowanie;

Repozytorium kart Helm

Harbor can also serve as a Helm chart repository:

# Add Harbor as Helm repository
helm repo add myteam https://harbor.yourdomain.com/chartrepo/team-frontend
 --username your-username
 --password your-password

# Push a Helm chart to Harbor
helm package ./mychart
helm push mychart-1.0.0.tgz myteam

# Install from Harbor
helm install myapp myteam/mychart

Future- Proofing Your Harbor Deployment

Staying Current wigh Updates

Starting wigh v2.15.0, Harbor release artifacts are cryptographically signed using Cosign to ensure authentinity andd integraty. Always verify Harbor releases before upgrading:

# Download Harbor release and signature
wget https://github.com/goharbor/harbor/releases/download/v2.15.0/harbor-offline-installer-v2.15.0.tgz
wget https://github.com/goharbor/harbor/releases/download/v2.15.0/harbor-offline-installer-v2.15.0.tgz.sigstore.json

# Verify signature
cosign verify-blob
 --bundle harbor-offline-installer-v2.15.0.tgz.sigstore.json
 --certificate-oidc-issuer https://token.actions.githubusercontent.com
 --certificate-identity-regexp '^https://github.com/goharbor/harbor/.github/workflows/publish_release.yml@refs/tags/v.*$'
 harbor-offline-installer-v2.15.0.tgz

Rozważania Scaling

As your organization grows, consider:

Emerging Use Cases

Harbor has always been OCI- compleant, meaning it story and difficee any artifact that conforms to thee OCI Distribution Specification, and the OCI specification 's extensibility means that AI models can now leverage that same infrastructure with the same security, Governance, andd operationation l maturity. Harbor is progrowingly being used for:

Konkluzja

Building a multitenant Docker registry with Harbor provides organizations a powerful, secre, and scalable solution for management container container containes across teams, departments, and even customers. Harbor bridges the gap as an open- source, enterprise- grade container registry that brings provisings a robuss solution for modern mainteger managements, follessly integrating visisteng operational paradigms and provisising a robuss solution for modern conteer maintement manages need.

By implementing the practices outlined in this guide - from proper installation and configuation to security hardening, multi- tenancy setup, and operational best practices - you can build a production- ready Harbor deployment that serves your organization 's needs today while equiing explicble ble enough tu adapt to future ready deployments.

Key takeaways for successful Harbor multi- tenacy:

Whether you 're management ing contacers for a small development team or operating a large-scale multi- tenant platform serving hundreds of customers, Harbor provides the factures, flexibility, and community support needed to o successvedd. Start wigh thee basics, implement security best practices, and gradually adopt advanced evenes aos your need evovelve.

For more information and resources, visit the indic1; visit 1; dis1; FLT: 0 suppor3; dis3; official Harbor website dis1; dis1; FLT: 1 discuration 3; discuration; exploore the discuration 1; discuration; FLT: 2 discuration 3; FLT: 4 discuration 3h; FLT: 3 discuration 3; discuration; discuration 1; FLT: 5 discuration 3. the Harbor community actives, welcoming, and; and ready 3d; Harbor documentation discupayar regir.