Harbor is an open-source container registry that provides security features including vulnerability scanning (integrated Trivy), image signing (Notary/Cosign), RBAC, content trust policies, replicatio. Use when working with securing container registry with harbor.
Harbor is an open-source container registry that provides security features including vulnerability scanning (integrated Trivy), image signing (Notary/Cosign), RBAC, content trust policies, replicatio. Use when working with securing container registry with harbor.
Harbor is an open-source container registry that provides security features including vulnerability scanning (integrated Trivy), image signing (Notary/Cosign), RBAC, content trust policies, replication, and audit logging. Securing Harbor involves configuring these features to enforce image provenance, prevent vulnerable image deployment, and maintain registry access control.
When to Use
Trigger phrases:
"securing container registry with harbor"
"Harbor is an open-source container registry that provides security features incl"
When deploying or configuring securing container registry with harbor capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation
Prerequisites
Harbor 2.10+ installed (Helm or Docker Compose)
TLS certificates for HTTPS
Trivy scanner integration
OIDC/LDAP for authentication
Kubernetes cluster (for deployment target)
Workflow
Scope the task — define objectives, boundaries, and success criteria
Gather information — collect all necessary data and context before proceeding
Execute the core workflow — follow the domain-specific steps methodically
Validate results — verify outputs against expected outcomes or baselines
Document findings — record results, anomalies, and recommendations
Step 1: Install Harbor with Security Configuration
# harbor-values.yaml for Helm deploymentexpose:type:ingresstls:enabled:truecertSource:secretsecret:secretName:harbor-tlsnotarySecretName:harbor-tls
# Harbor configuration for OIDCauth_mode:oidc_authoidc_name:"Okta"oidc_endpoint:"https://company.okta.com/oauth2/default"oidc_client_id:"harbor-client-id"oidc_client_secret:"harbor-client-secret"oidc_groups_claim:"groups"oidc_admin_group:"harbor-admins"oidc_scope:"openid,profile,email,groups"oidc_verify_cert:trueoidc_auto_onboard:true
Validation Commands
# Test vulnerability prevention (should block pull of vulnerable image)
docker pull harbor.example.com/production/vulnerable-app:latest
# Expected: Error - image blocked due to vulnerabilities# Verify content trust enforcement
DOCKER_CONTENT_TRUST=0 docker push harbor.example.com/production/unsigned:latest
# Expected: Push rejected due to content trust policy# Check scan results via API
curl -k "https://harbor.example.com/api/v2.0/projects/production/repositories/myapp/artifacts/v1.0.0/additions/vulnerabilities" \
-H "Authorization: Basic $(echo -n admin:Harbor12345 | base64)"# Audit log check
curl -k "https://harbor.example.com/api/v2.0/audit-logs?page=1&page_size=10" \
-H "Authorization: Basic $(echo -n admin:Harbor12345 | base64)"
When NOT to Use
You need to test security controls (use performing-* skills)
Task is about detecting bypasses (use detecting-* skills)
You need to analyze security events (use analyzing-* skills)
Task is about building security tools (use building-* skills)
