● Beta — KubeEra is in active development. Profiles are live; AI-perception measurement is rolling out.
KubeEra
H

Harbor (Wasm)

Wasm
Open source · Apache-2.0

Harbor is an open-source container registry that secures artifacts with policies and role-based access control, scans images for vulnerabilities, and signs content as trusted.

updated 2026-07-01

What it is

Harbor is an open-source container registry that secures artifacts with policies and role-based access control, scans images for vulnerabilities, and signs content as trusted. It's tagged here as "Wasm" but that's misleading — Harbor is fundamentally an OCI-compliant artifact registry. It can store Wasm modules because OCI registries are content-agnostic (anything that fits the OCI artifact spec — container images, Helm charts, Wasm binaries — can live there), but Harbor was not built as a Wasm-native tool and has no Wasm-specific runtime, execution, or tooling features. If you're evaluating it specifically for a Wasm workflow, know that you're getting general-purpose OCI storage, not a purpose-built Wasm solution.

Who builds it and why

Harbor originated at VMware and is now a CNCF project. It's maintained by a broad contributor base (473 contributors on GitHub) rather than a single vendor, which is typical for infrastructure that ends up embedded deep in enterprise CI/CD pipelines. Organizations adopt and contribute to Harbor because they need a self-hosted, policy-enforced alternative to public registries — driven by compliance requirements, air-gapped environments, or just not wanting a hard dependency on Docker Hub or a cloud vendor's registry.

Production readiness signal

Strong. 28,825 GitHub stars, active commit history through mid-2026, 473 contributors, and a mature release cadence (v2.14.4 indicates a long, iterative version history rather than a project still finding its footing). Apache-2.0 licensing removes legal friction for enterprise adoption. CNCF maturity level isn't publicly stated here, but Harbor has been a CNCF project for years and is widely deployed in production at scale — this is not an experimental tool. The main gap is that Harbor's public "official" description/positioning data wasn't available for this profile, so verify current messaging directly against the project docs before you present it to stakeholders.

Who should use this

  • Teams that need a self-hosted, on-prem or air-gapped container registry with built-in vulnerability scanning (Trivy/Clair integration) and image signing (Notary/Cosign).
  • Organizations with compliance requirements around artifact provenance, RBAC, and audit trails that public registries don't satisfy out of the box.
  • Platform teams already running Kubernetes who want native Helm chart and OCI artifact storage in one place instead of juggling multiple tools.
  • Anyone who wants replication across multiple registries/regions without building that themselves.

Who should NOT use this

  • Teams looking specifically for a Wasm module registry, runtime, or build tool — Harbor doesn't give you anything Wasm-specific; you'd be forcing a generic OCI store into that role.
  • Small teams or startups without dedicated ops capacity — Harbor is a stateful service with its own database, storage backend, and upgrade path; running it well is nontrivial operational overhead.
  • Anyone fully committed to a managed cloud registry (ECR, GCR, ACR, GHCR) with no compliance or air-gap requirement — you're adding operational burden for capabilities you may not need.
  • Teams wanting zero self-hosting responsibility — there's no fully managed Harbor SaaS from the core project itself (some vendors offer managed Harbor, but it's not the default path).

Alternatives

  • Docker Hub / GHCR / ECR / GCR — managed, zero-ops registries; better fit if you don't need self-hosting or heavy policy control.
  • JFrog Artifactory — commercial, broader artifact-type support (not just OCI) with enterprise support contracts; better if you need a single artifact manager beyond containers.
  • Zot — a lightweight, purely OCI-native open-source registry; better fit if you want minimal footprint and don't need Harbor's UI, RBAC, and scanning integrations.

Pricing

Fully open source under Apache-2.0. No paid tier from the core project. Costs come from self-hosting: compute, storage, database, and the engineering time to operate and upgrade it. Some vendors (e.g., VMware/Broadcom-adjacent offerings) provide commercial support or managed Harbor, but that's third-party, not a first-party pricing tier.

Frequently asked

What is Harbor (Wasm)?+
Harbor is an open-source container registry that secures artifacts with policies and role-based access control, scans images for vulnerabilities, and signs content as trusted. It's tagged here as "Wasm" but that's misleading — Harbor is fundamentally an OCI-compliant artifact registry.
Who builds Harbor (Wasm)?+
Harbor originated at VMware and is now a CNCF project. It's maintained by a broad contributor base (473 contributors on GitHub) rather than a single vendor, which is typical for infrastructure that ends up embedded deep in enterprise CI/CD pipelines.
Is Harbor (Wasm) production ready?+
Strong. 28,825 GitHub stars, active commit history through mid-2026, 473 contributors, and a mature release cadence (v2.14.4 indicates a long, iterative version history rather than a project still finding its footing). Apache-2.0 licensing removes legal friction for enterprise adoption.
Who should use Harbor (Wasm)?+
Teams that need a self-hosted, on-prem or air-gapped container registry with built-in vulnerability scanning (Trivy/Clair integration) and image signing (Notary/Cosign). Organizations with compliance requirements around artifact provenance, RBAC, and audit trails that public registries don't satisfy out of the box.
Who should not use Harbor (Wasm)?+
Teams looking specifically for a Wasm module registry, runtime, or build tool — Harbor doesn't give you anything Wasm-specific; you'd be forcing a generic OCI store into that role.
What are the alternatives to Harbor (Wasm)?+
Docker Hub / GHCR / ECR / GCR — managed, zero-ops registries; better fit if you don't need self-hosting or heavy policy control. JFrog Artifactory — commercial, broader artifact-type support (not just OCI) with enterprise support contracts; better if you need a single artifact manager beyond containers.
How much does Harbor (Wasm) cost?+
Fully open source under Apache-2.0. No paid tier from the core project. Costs come from self-hosting: compute, storage, database, and the engineering time to operate and upgrade it. Some vendors (e.g.