DOCSEARCHbyAlgolia
Submit Docs

Harbor Documentation

website·Indexed 40 days ago

https://goharbor.io/docs

Documentation for Harbor, an open-source cloud-native registry. Includes guides for installation, configuration of LDAP/Active Directory authentication, project management, Helm chart handling via ChartMuseum, and REST API usage via Swagger. Also provides comprehensive Harbor CLI reference for managing repositories, artifacts, users, and registries.

Tokens
877K
Snippets
3K
Records
6.3K
Agent score
50%

What's inside Harbor

  1. Overview of Harbor metrics and observability

    Harbor exposes key operational and performance metrics using the Prometheus data model, allowing administrators to monitor instance health and identify abnormal statuses in real time. Metrics are available starting from Harbor v2.2 and must be enabled in the Harbor configuration file. Metrics are exposed via the endpoint <harbor_instance>:<metrics_port>/<metrics_path>.

  2. Overview of Harbor System Robot Accounts

    System-wide robot accounts in Harbor provide non-user-scoped credentials used to perform operations and API calls across multiple projects. Unlike user accounts, robot accounts cannot be used to log into the Harbor user interface. They can be assigned a combination of system-level permissions and project-level permissions across one or more projects.

  3. Overview of Harbor Proxy Cache

    Proxy cache allows Harbor to act as an intermediary that proxies and caches images from a target public or private registry. This is useful for environments with limited internet access, reducing bandwidth consumption, or avoiding rate limits from public registries.

    Supported registries include:

    • Harbor
    • Docker Hub
    • Docker registry
    • AWS Elastic Container Registry (ECR)
    • Azure Container Registry (ACR)
    • Google Container Registry (GCR)
    • Quay
    • GitHub Container Registry (GHCR)
    • JFrog Artifactory Registry

    Key Constraints:

    • You cannot push images directly to a proxy cache project.
    • It is strongly recommended to use Harbor v2.1.1 or later to avoid Docker Hub rate limiting, as it uses HEAD requests to check for image updates.

  4. Overview of Harbor Proxy Cache

    Harbor Proxy Cache allows Harbor to act as an intermediary that proxies and caches images from a target public or private registry. This is useful for environments with limited internet access, reducing bandwidth consumption, or avoiding registry throttling (such as Docker Hub rate limits). Harbor supports proxy caching for registries including Harbor, Docker Hub, Docker registry, AWS ECR, Azure Container Registry, Google Container Registry, Quay, GitHub Container Registry, and JFrog Artifactory Registry.

  5. Overview of Harbor System Robot Accounts

    System robot accounts allow administrators to perform automated maintenance or repeated tasks across all or a subset of projects in a Harbor instance. Unlike project-scoped robot accounts, system robot accounts can span multiple projects.

    Key Constraints:

    • Robot accounts cannot log in to the Harbor user interface; they are used via OCI clients or the Harbor API.
    • The Push Repository permission requires the Pull Repository permission to be assigned simultaneously; it cannot be granted alone.

  6. Overview of Harbor System Robot Accounts

    System robot accounts allow administrators to perform maintenance or repeated automated tasks across all or a subset of projects in a Harbor instance. These accounts are used via OCI clients or the Harbor API and cannot be used to log into the Harbor user interface.

    Available permissions for system robot accounts include:

    • Repository: List, Pull, Push, Delete
    • Artifact: Read, List, Delete, Create Label, Delete Label
    • Tag: Create, Delete, List
    • Scan: Create, Stop
    • Helm Chart: Read, Create Version, Delete Version, Create Label, Delete Label

  7. Overview of Harbor Replication

    Replication in Harbor allows for the movement of images and charts between Harbor and other registries (both Harbor and non-Harbor) using either pull or push modes.

    Key behaviors include:

    • Automatic Namespace Creation: If a target namespace does not exist in the destination registry, Harbor creates it automatically.
    • Permissions: The user account configured in the replication policy must have write privileges in the destination namespace, or the process will fail.
    • Filtering: Resources are replicated based on filter patterns defined in the replication rule.
    • Retry Logic: If a replication task fails, it is rescheduled and retried several times after a few minutes.
    • Limitations: Member information is not replicated. Additionally, replication between different versions of Harbor is not supported due to API changes.

  8. Overview of Harbor Proxy Cache

    Harbor Proxy Cache allows Harbor to act as a proxy and cache for images from a target public or private registry. This is useful for environments with limited internet access, reducing bandwidth consumption, or avoiding rate limits from public registries.

    Supported registries include:

    • Harbor
    • Docker Hub
    • Docker registry
    • AWS Elastic Container Registry (ECR)
    • Azure Container Registry (ACR)
    • Google Container Registry (GCR)
    • Quay
    • GitHub Container Registry (GHCR)
    • JFrog Artifactory Registry

    Note: It is strongly recommended to use Harbor v2.1.1 or later to align with Docker Hub's rate limit policy, as it uses HEAD requests to check for updates without triggering the rate limiter.

  9. Overview of Harbor System Administrator responsibilities

    The Harbor system administrator is responsible for global configuration and maintenance of the Harbor instance. Key administrative tasks include:

    • Authentication: Configuring database, LDAP/Active Directory, or OIDC authentication.
    • User Management: Adding users in database mode and assigning administrator roles.
    • Global Settings: Managing registry read-only mode and project creation restrictions.
    • Resource Management: Applying resource quotas to projects and performing garbage collection to remove unnecessary data.
    • Image Distribution: Setting up image replication between Harbor instances or 3rd party targets, and configuring P2P preheat providers.
    • Security: Setting up vulnerability scanners for CVEs and managing user-defined OCI artifacts.
    • Observability & Logging: Configuring audit log retention, syslog endpoints for log forwarding, and accessing metrics/distributed tracing.
    • Lifecycle: Upgrading Harbor to new versions.

  10. Overview of Harbor Proxy Cache

    Harbor Proxy Cache allows Harbor to act as an intermediary that proxies and caches images from a target public or private registry. This is useful for environments with limited internet access, reducing bandwidth consumption, or avoiding rate limits from public registries.

    Supported registries include:

    • Harbor
    • Docker Hub
    • Docker registry
    • AWS Elastic Container Registry (ECR)
    • Azure Container Registry (ACR)
    • Google Container Registry (GCR)
    • Quay
    • GitHub Container Registry
    • JFrog Artifactory Registry

    Starting with v2.1.1, Harbor uses HEAD requests to check for updates in Docker Hub to avoid triggering rate limits unless an image layer has actually changed.

  11. Overview of Harbor Replication

    Replication in Harbor allows the movement of images and charts between Harbor and other registries (both Harbor and non-Harbor) using either pull or push modes.

    Key behaviors include:

    • Automatic Triggering: Resources matching defined filter patterns are replicated when triggering conditions are met.
    • Namespace Handling: If a destination namespace does not exist, Harbor creates it automatically. If it exists but the configured user lacks write privileges, the replication fails.
    • Task Management: Each replicated resource initiates a replication task. Failed tasks are automatically rescheduled and retried after a few minutes.
    • Limitations: Member information is not replicated. Additionally, replication between different versions of Harbor is not supported due to API changes.

  12. Overview of Harbor P2P Image Preheating

    P2P preheating in Harbor allows administrators to distribute and cache images across a P2P engine (such as Dragonfly v1.0.5+ or Uber Kraken v0.1.3+) before they are requested by clients. This reduces the load on the registry and accelerates image pulling.

    Key components of the workflow include:

    1. P2P Engine Installation: A P2P engine must be installed in the environment before Harbor can be configured to use it.
    2. Preheat Provider Instances: System administrators create provider instances by configuring the P2P vendor's API endpoint and necessary credentials. These instances are shared across all projects.
    3. Preheat Policies: Project administrators define policies to determine which images are preheated based on resource filters and criteria (e.g., content trust and vulnerability status). Policies can be triggered manually, on a schedule, or based on specific events.
    4. Execution Tracking: Harbor logs every preheating policy execution, which can be reviewed on the Project's page.