Harbor Next

Harbor is a CNCF graduated open-source container registry to store and manage container images and other OCI artifacts securely with policies, role-based access control, vulnerability scans and signing.

Harbor is hosted by the Cloud Native Computing Foundation (CNCF). If you are an organization that wants to help shape the evolution of Harbor, reach out to us.

What is Harbor Next

Harbor Next is a community-driven evolution of Harbor, designed to accelerate innovation and lower the barrier to entry for contributors. It serves as the foundation for 8gcr (8gears Container Registry), used across enterprises, government agencies, and cloud providers.

We're developing Harbor Next as a community proposal with the goal of advancing Harbor and the container registry ecosystem.

• Harbor Next and CNCF Harbor cross-pollinate: Harbor Next cherry-picks features and fixes from Harbor, and upstream Harbor adopts features and concepts proven in Harbor Next.
• Harbor Next follows Harbor's release cadence. The main branch always targets the next development release in VERSION; published release state is tracked by release-please.
• Harbor Next is a drop-in replacement for Harbor.

Notable Changes in Harbor Next

• Contributor/Maintainer ladder automation
• Continuous delivery
• Easy Contributor onboarding with out of the box dev environments
• Multi-architecture artifacts
• Scratch images with minimal size and attack surface.
• Use of Docker Distribution V3
• Replicate images to SFTP endpoints
• Harbor Satellite Support
• Versatile Helm Chart
• Open Compose (install.sh less) supporting Docker & Podman Compose
• Support for OpenShift, Rancher, k3s, Nutanix (NKP)
• Prepending vetted features not yet upstream — see the release notes
• See ROADMAP.md for more...

Harbor Features

• Cloud native registry: Stores container images and OCI artifacts, including Helm charts as OCI artifacts, for container runtimes and orchestration platforms.
• Role based access control: Users access repositories through 'projects', with per-project permissions on the artifacts they contain.
• Policy based replication: Replicate artifacts between registry instances by policy and filters (repository, tag, label) with automatic retries — for load balancing, high availability, and multi-datacenter/hybrid/multi-cloud deployments.
• Vulnerability scanning: Scans images for vulnerabilities and enforces policy checks to block vulnerable images from being deployed.
• LDAP/AD support: Integrates with enterprise LDAP/AD for authentication and group import, mapping groups to project permissions.
• OIDC support: Authenticates users via OpenID Connect against an external identity provider, with single sign-on into the portal.
• Image deletion & garbage collection: Delete artifacts and reclaim storage by running garbage collection on dangling manifests and unreferenced blobs.
• Image signing & verification: Released images are signed with keyless cosign signatures — see docs/signature-verification.md.
• Graphical user portal: Browse, search repositories, and manage projects from the web UI.
• Auditing: All repository operations are tracked through logs.
• RESTful API: REST APIs for administrative operations and integration, with an embedded Swagger UI for exploring and testing.
• Easy deployment: Deploy via Docker/Podman Compose or the Harbor Next Helm chart.

Architecture

For the architecture design of Harbor Next, see Architecture Overview.

API

Harbor Next exposes a RESTful API for administrative operations and integration. Explore it in the Swagger editor or from the source spec api/v2.0/swagger.yaml.

Install & Run

System requirements: Docker Engine 24+ with Compose v2.24+.

Docker Compose — see deploy/compose/README.md:

cd deploy/compose
cp .env.example .env          # set EXT_ENDPOINT, TLS_CERT/TLS_KEY, and secrets
docker compose up -d

Kubernetes — install the Harbor Next Helm chart (deploy/chart/, also published as an OCI artifact; under active development). Platform guides live in deploy/chart/docs/guide/ (k3s, OpenShift, Rancher, Nutanix).

Development

Harbor Next uses Taskfile for local development and in pipelines for a fast, hybrid development environment with hot reload capabilities.

Prerequisites

Tool	Version	Purpose
Task	v3.x	Build system (replaces Make)
Docker / Podman	20.10.10+	Dev environment, linting, image builds
Go	see versions.env	Backend compilation and tests
Bun	see versions.env	Frontend dependency management
Node.js	16+	Frontend build, tests, and API codegen
Git	any	Required by build metadata and mock checks

Additional Go tools (air, dlv, govulncheck) are auto-installed on first use via go install or by running task setup.

Quick Start

# Install Task
brew install go-task/tap/go-task  # macOS
# or: sh -c "$(curl --location https://taskfile.dev/install.sh)" -- -d  # Linux

# Start DevEnv
task

# Open http://localhost:4200

Common Commands

task                     # Start full dev environment (foreground)
task setup               # Install development tools (air, dlv, govulncheck)
task build               # Build all binaries (alias: task b:all-binaries)
task images              # Build all Docker images
task test                # Run all tests (alias: task t:all)
task lint                # Run API lint, Go lint, and vuln-check
task test:unit:pure      # Run pure unit tests only
task test:unit:db        # Run DB-backed unit tests only
task clean               # Clean build artifacts
task info                # Show build info and tool versions
task -l                  # List all available tasks

Namespace aliases: b: (build), t: (test), img: (image), d: (dev).

See devenv/README.md for detailed development environment commands.

Contributing

Contributions are welcome. See CONTRIBUTING.md for the PR workflow, commit conventions (Conventional Commits + DCO sign-off), squash-merge rules, and how releases work. New contributors can get a dev environment running with task (see Development).

Compatibility

The compatibility list document provides compatibility information for the Harbor components.

• Replication adapters
• OIDC adapters
• Scanner adapters

Community

• Twitter: @project_harbor
• User Group: Join Harbor user email group: harbor-users@lists.cncf.io to get update of Harbor's news, features, releases, or to provide suggestion and feedback.
• Developer Group: Join Harbor developer group: harbor-dev@lists.cncf.io for discussion on Harbor development and contribution.
• Slack: Join Harbor's community for discussion and ask questions: Cloud Native Computing Foundation, channel: #harbor and #harbor-dev

Demos

• Live Demo - A demo environment with the latest Harbor-Next build.
• Harbor Demo Videos - Demos for Harbor features and continuously updated.

Partners and Users

For a list of users, please refer to ADOPTERS.md.

License

Harbor is available under the Apache 2 license.