🩺 Vitals
- 🟢 Last active: 2026-08-31
- 📦 Latest release: v2.15.2 (2026-07-02)
- 🐞 Open issues: 874
- 🌟 Stars: 29.3k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: goharbor.io
- Source: github.com/goharbor/harbor
- License: Apache 2.0
- Deployment: Docker | Kubernetes
- Data Model: PostgreSQL and Redis with a filesystem or S3-compatible storage backend
- Jurisdiction: USA 🇺🇸 (CNCF / Linux Foundation)
- Compliance (SaaS): N/A
- Compliance (Self-Hosted): Self-Hosted (User Managed)
- Complexity: High (4/5) - Multi-service stack (PostgreSQL, Redis, storage); Docker Compose or Helm
- Maintenance: Medium (3/5) - Dependent services and a database to back up and upgrade
- Enterprise Ready: High (5/5) - OIDC/LDAP SSO, RBAC, audit logs, replication and scanning all included, CNCF-governed
1. The Executive Summary
What is it? Harbor is a self-hosted registry for container images and OCI artifacts that adds the governance layer a bare registry lacks: role-based access control, vulnerability scanning, image signing, replication and audit logging. Any OCI-compatible client pushes images to Harbor, which stores, scans and signs them before they reach production. As a CNCF Graduated project under the Linux Foundation, it is vendor-neutral, and every one of those capabilities ships in the free Apache-licensed core with no enterprise edition to buy.
The Strategic Verdict:
- 🟢 For a sovereign container supply chain: Strong Buy. You get a private, self-hosted registry with scanning, signing and RBAC included, under neutral foundation governance rather than a single vendor's roadmap.
- 🔴 For a small team wanting a lightweight registry: Weigh the operational cost. Harbor runs PostgreSQL, Redis and a storage backend; if you only need to store images without the governance layer, a minimal registry is far lighter to run.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | JFrog Artifactory (Commercial) | Harbor (Self-Hosted) |
|---|---|---|
| Licensing | Per-tier enterprise subscription | None (Apache 2.0) |
| Scanning & Signing | Higher-tier feature | Included (Trivy, Cosign/Notation) |
| SSO, RBAC & Replication | Enterprise tier | Included |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: A Docker Compose installer (online or air-gapped offline bundle) for a single host, or the Harbor Operator and Helm chart on Kubernetes. Either path is a multi-service deployment, not a single container.
- Dependent services are yours to run: Harbor is not a single binary. It relies on PostgreSQL, Redis and a storage backend (local filesystem or S3-compatible object storage), each of which you provision, back up and upgrade.
- Supply-chain controls are built in: Vulnerability scanning (Trivy), image signing (Cosign and Notation), SBOM generation and fine-grained RBAC come with the core. This is what turns a plain image store into a control point you can audit.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & Foundation Governance: Harbor is a CNCF Graduated project stewarded by the Linux Foundation, a US-based non-profit, with open governance and supermajority voting across diverse corporate maintainers. This is its defining strength: there is no single vendor who can paywall a feature or redirect the roadmap unilaterally. Standard US export regulation applies to the foundation, but the software stores only the artifacts you place in it.
- The Compliance Shift: Self-hosting moves infrastructure security, patching and node operation onto you. Harbor supplies the application-level controls (RBAC, scanning, signing, SBOM) that a CRA-aligned or audited supply chain expects, which removes a large part of the build-out. Providing those controls is not the same as holding a certification: no SOC 2, ISO 27001 or CRA attestation attaches to the software, and certifying your deployment remains your responsibility.
- Operational Weight, Not Licence Risk: Apache 2.0 carries no copyleft or network clause, and no feature is paywalled, so there is no commercial trap. The trade-off is operational: Harbor is a multi-service application with no first-party commercial support tier, so you either own the operational burden or contract third-party support for it.
4. Market Landscape
🏢 Proprietary Incumbents
- JFrog Artifactory: The enterprise artifact registry, broad in format support but licensed per tier, with scanning and advanced access control concentrated in the higher-priced editions.
- Docker Hub: The ubiquitous managed registry. Convenient, but it meters pulls and storage, applies rate limits to free usage, and keeps your images on a third-party service rather than your infrastructure.
🤝 Open Source Ecosystem
- Distribution (Docker Registry): The minimal CNCF registry that Harbor builds upon. It stores and serves OCI artifacts but has none of the RBAC, scanning, signing or replication that Harbor layers on top.
- Quay: Red Hat's registry with comparable scanning and signing. Its core is open source (Project Quay), but its center of gravity sits inside Red Hat's commercial platform rather than neutral governance.