● Beta — KubeEra is in active development. Profiles are live; AI-perception measurement is rolling out.
KubeEra
H

Harbor

GraduatedProvisioning & Security
Open source · CNCF · CNCF Graduated · Apache-2.0

Harbor is an open-source container registry that stores, signs, and scans OCI images and Helm charts.

updated 2026-07-01

What it is

Harbor is an open-source container registry that stores, signs, and scans OCI images and Helm charts. It sits in the "Provisioning" layer of a Kubernetes platform — the thing your CI pipeline pushes images to and your clusters pull them from. Beyond basic push/pull, it handles RBAC, vulnerability scanning (via Trivy or Clair), image signing/verification (Notary/Cosign), replication between registries, and retention policies. Think of it as the artifact control plane that sits between "docker build" and "kubectl apply."

Who builds it and why

Harbor was originally built by VMware, donated to CNCF in 2018, and graduated in 2020 — CNCF's highest maturity tier, meaning it's passed security audits and demonstrated broad, diverse production adoption. It now has 473 contributors and an active maintainer base spanning multiple companies, not a single vendor. The project ships regular point releases (currently v2.14.4), and commit activity is continuous, not sporadic. This isn't a side project — it's infrastructure that large enterprises depend on for supply-chain security, which is exactly why it needed CNCF governance rather than living under one company's roadmap.

Production readiness signal

28,800+ GitHub stars and graduated CNCF status are table stakes at this point — the real signal is the contributor count (473) and commit cadence. A registry is not a place to run unmaintained software; CVEs in registries are a direct supply-chain attack vector. Harbor's maintenance activity suggests it's getting the security attention a registry needs. Apache-2.0 licensing means no legal ambiguity for commercial use. The one gap: founding date and adoption numbers aren't publicly tracked in a way I can cite, so you're relying on CNCF graduation and GitHub activity as your primary signals — which, for a registry, is enough to justify a pilot but not enough to skip your own load testing.

Who should use this

  • Teams running multi-cluster or hybrid Kubernetes environments that need a private registry with RBAC and project-based isolation.
  • Organizations with compliance requirements around image scanning, signing, and provenance (Harbor's Trivy/Cosign integration checks these boxes without extra tooling).
  • Platform teams that need registry replication across regions or between air-gapped and connected environments.
  • Anyone currently on a bare Docker Registry (distribution/distribution) who needs UI, auth, and policy on top of it.

Who should NOT use this

  • Small teams or single-cluster shops already paying for a managed registry (ECR, GCR, ACR, GHCR). Harbor adds operational overhead — you're now running a stateful service with a database, Redis, and object storage dependencies — that isn't worth it unless you need Harbor-specific features like fine-grained replication or on-prem hosting.
  • Anyone who can't dedicate ops time to running it. Harbor is not "install and forget" — upgrades, storage backend management, and scanning engine updates require real attention.
  • Air-gapped-only shops that just need dumb artifact storage — a simpler OCI-compliant registry (like plain Distribution or a cloud-managed one) is less to maintain.
  • Teams wanting a fully managed SaaS experience with vendor support SLAs baked in — Harbor is self-hosted by design; commercial support exists but isn't the default path.

Alternatives

  • Docker Distribution (Registry) — the bare-metal OCI registry Harbor is built on top of; use it if you just need storage with no UI, RBAC, or scanning.
  • Cloud-managed registries (ECR/GCR/ACR/GHCR) — zero ops overhead, tightly integrated with their respective cloud IAM, but less portable and fewer policy controls.
  • JFrog Artifactory — commercial, multi-format artifact manager (not just containers) with enterprise support; better if you need one tool for containers, npm, Maven, etc.

Pricing

Fully open source under Apache-2.0. No paid tier, no license gating — you run it, you own the infrastructure cost. Commercial support is available through third parties (e.g., VMware/Broadcom historically), but the core project has no licensing fees.

Frequently asked

What is Harbor?+
Harbor is an open-source container registry that stores, signs, and scans OCI images and Helm charts. It sits in the "Provisioning" layer of a Kubernetes platform — the thing your CI pipeline pushes images to and your clusters pull them from.
Who builds Harbor?+
Harbor was originally built by VMware, donated to CNCF in 2018, and graduated in 2020 — CNCF's highest maturity tier, meaning it's passed security audits and demonstrated broad, diverse production adoption. It now has 473 contributors and an active maintainer base spanning multiple companies, not a single vendor.
Is Harbor production ready?+
28,800+ GitHub stars and graduated CNCF status are table stakes at this point — the real signal is the contributor count (473) and commit cadence. A registry is not a place to run unmaintained software; CVEs in registries are a direct supply-chain attack vector.
Who should use Harbor?+
Teams running multi-cluster or hybrid Kubernetes environments that need a private registry with RBAC and project-based isolation. Organizations with compliance requirements around image scanning, signing, and provenance (Harbor's Trivy/Cosign integration checks these boxes without extra tooling).
Who should not use Harbor?+
Small teams or single-cluster shops already paying for a managed registry (ECR, GCR, ACR, GHCR).
What are the alternatives to Harbor?+
Docker Distribution (Registry) — the bare-metal OCI registry Harbor is built on top of; use it if you just need storage with no UI, RBAC, or scanning. Cloud-managed registries (ECR/GCR/ACR/GHCR) — zero ops overhead, tightly integrated with their respective cloud IAM, but less portable and fewer policy controls.
How much does Harbor cost?+
Fully open source under Apache-2.0. No paid tier, no license gating — you run it, you own the infrastructure cost. Commercial support is available through third parties (e.g., VMware/Broadcom historically), but the core project has no licensing fees.