Harbor in Practice

Installing Harbor takes twenty minutes. Being the person responsible for it does not.

The registry is where an auditor's questions land: what is running, where did it come from, and who could have changed it. Harbor answers all three — once somebody has decided how it authenticates, what it refuses to serve, what deletes things, how it is backed up, and what happens when the backup is needed.

This book is about becoming that somebody. You type.

Twenty-four chapters, twenty-three of them ending in a lab that runs on your laptop. No cloud account, no spare server, no credit card. Build a registry from an empty machine to something you would hand over:

• Install Harbor twice — on a virtual machine and on Kubernetes — then read the chapter that says which one you should actually be running, and why

• Give machines their own identities with robot accounts, and find out what happens when one expires at 3 a.m.

• Refuse a deployment three ways: unscanned, too vulnerable, unsigned

• Sign images with a key that never leaves HashiCorp Vault, and verify them in the cluster

• Write a retention rule, run it as a dry run, and learn why the number it reports is an upper bound rather than a promise

• Delete four hundred artifacts and watch the disk not shrink

• Take a backup in an order you can defend, then restore it and prove it with a digest

• Upgrade a schema that only migrates forwards, and discover that the rollback plan is the restore

Several chapters break things on purpose. You will restore a registry that lists images nobody can pull. You will lose the encryption key that is not in the database and watch every replication fail with an error that points nowhere. You will scale a component to three replicas and find two of them stuck forever.

Every chapter has a Break it on purpose section: the real error text, the cause, the fix. By the end the errors are recognisable rather than alarming.

Every command was run. Every number was checked. The book is pinned to Harbor v2.15.2 and chart v1.19.2, and the companion repository re-checks its claims in CI — including the ones the book makes about Harbor's own behaviour. That discipline found errors in Harbor's documentation while this book was being written, and the book prints them: two configuration paths in the official high-availability guide that Helm accepts and silently ignores; a backup procedure that omits the one file without which the restore is worthless; and read-only mode, which does not stop the garbage collector.

There is no exam. Harbor has no certification, so the book does not pretend otherwise. In its place, Appendix F is a production readiness review: fifty-four items across eight sections, thirty-two of which a script in the repository checks for you. The rest are questions only you can answer, and the appendix says so.

Who this is for: platform engineers, SREs, DevOps and security engineers who will be responsible for a registry — whether they chose it or inherited it. You need to be comfortable in a terminal and to have met a container. You do not need prior Harbor experience.

Includes nine appendices: tool installation for macOS, Linux and Windows, a harbor.yml reference that documents where the VM installer and the Helm chart disagree, an API cookbook whose every path is verified against the 135 the specification defines, ports and volumes, every error message in the book indexed by text, the readiness review, a lab teardown, a migration guide, and a map of the web interface for the four operations that have no API at all.