Harbor

https://goharbor.io/docs/2.14.0/
Admin
Harbor is an open-source container image registry that extends Docker Registry with role-based...
Tokens:38,991
Snippets:554
Trust Score:9.7
Update:1 month ago
Show doc for...
Tokens:
Raw
### Build and run Harbor from source

Source: https://goharbor.io/docs/2.14.0/build-customize-contribute/use-make

Executes the full build, image creation, and installation process to start a Harbor instance.

```bash
make install
```

--------------------------------

### Install Notation CLI

Source: https://goharbor.io/docs/2.14.0/working-with-projects/working-with-images/sign-images

Install the Notation CLI using Homebrew.

```bash
brew install notation
```

--------------------------------

### Verify Installation

Source: https://goharbor.io/docs/2.14.0/build-customize-contribute/compile-guide

Expected output upon successful startup.

```text
...
Start complete. You can visit harbor now.
```

--------------------------------

### Start Development Server

Source: https://goharbor.io/docs/2.14.0/build-customize-contribute/ui-contribution-get-started

Launches the local development server for the Harbor frontend.

```bash
npm run start
```

--------------------------------

### Run Default Harbor Installation

Source: https://goharbor.io/docs/2.14.0/install-config/run-installer-script

Executes the installer script without the Trivy service.

```bash
sudo ./install.sh
```

--------------------------------

### Install Dependencies

Source: https://goharbor.io/docs/2.14.0/build-customize-contribute/ui-contribution-get-started

Installs necessary npm packages and third-party dependencies.

```bash
npm install
```

--------------------------------

### Verify Installer Signature

Source: https://goharbor.io/docs/2.14.0/install-config/download-installer

Use GPG to verify the signature of the downloaded installer against the corresponding .asc file.

```bash
gpg -v --keyserver hkps://keyserver.ubuntu.com --verify harbor-online-installer-version.tgz.asc
```

```bash
gpg -v --keyserver hkps://keyserver.ubuntu.com --verify harbor-offline-installer-version.tgz.asc
```

--------------------------------

### Start Harbor Services

Source: https://goharbor.io/docs/2.14.0/install-config/reconfigure-manage-lifecycle

Re-creates and starts the Harbor instance in detached mode.

```bash
sudo docker compose up -d
```

--------------------------------

### Run Harbor Installation with Trivy

Source: https://goharbor.io/docs/2.14.0/install-config/run-installer-script

Executes the installer script including the Trivy vulnerability scanning service.

```bash
sudo ./install.sh --with-trivy
```

--------------------------------

### Build Harbor with Official Golang Image

Source: https://goharbor.io/docs/2.14.0/build-customize-contribute/compile-guide

Compile and install Harbor using the official Golang container image.

```bash
make install COMPILETAG=compile_golangimage
```

--------------------------------

### Enable HTTPS with prepare script

Source: https://goharbor.io/docs/2.14.0/install-config/configure-https

Run the prepare script located in the Harbor installer bundle to configure the nginx reverse proxy for HTTPS.

```bash
./prepare
```

--------------------------------

### GPG Verification Output Example

Source: https://goharbor.io/docs/2.14.0/install-config/download-installer

Example output indicating a successful signature verification.

```text
gpg: armor header: Version: GnuPG v1
gpg: assuming signed data in 'harbor-online-installer-v2.0.2.tgz'
gpg: Signature made Tue Jul 28 09:49:20 2020 UTC
gpg:                using RSA key 644FF454C0B4115C
gpg: using pgp trust model
gpg: Good signature from "Harbor-sign (The key for signing Harbor build) <jiangd@vmware.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 7722 D168 DAEC 4578 06C9  6FF9 644F F454 C0B4 115C
gpg: binary signature, digest algorithm SHA1, key algorithm rsa4096
```

--------------------------------

### Trust Certificates on Ubuntu

Source: https://goharbor.io/docs/2.14.0/install-config/troubleshoot-installation

Install the certificate bundle to the system trust store on Ubuntu systems.

```bash
cp yourdomain.com.crt /usr/local/share/ca-certificates/yourdomain.com.crt 
update-ca-certificates
```

--------------------------------

### Install OCI Helm Charts

Source: https://goharbor.io/docs/2.14.0/working-with-projects/working-with-oci/working-with-helm-oci-charts

Deploy a release directly from an OCI-compliant Helm chart stored in Harbor.

```bash
helm install <release_name> oci://<harbor_address>/<project>/<chart_name> --version <version>
```

```bash
helm install MyRelease oci://demo.goharbor.io/oci/demo --version 0.1.0
```

--------------------------------

### Format command line examples

Source: https://goharbor.io/docs/2.14.0/build-customize-contribute/style-guide

Commands should be presented without the shell prompt, and command execution should be separated from its output.

```bash
kubectl get pods
```

```bash
kubectl get pods --output=wide
```

```text
NAME     READY     STATUS    RESTARTS   AGE    IP           NODE
nginx    1/1       Running   0          13s    10.200.0.4   worker0
```

--------------------------------

### Copy Certificates to Docker

Source: https://goharbor.io/docs/2.14.0/install-config/configure-https

Install the server certificate, key, and CA file into the Docker configuration directory.

```bash
cp yourdomain.com.cert /etc/docker/certs.d/yourdomain.com/
cp yourdomain.com.key /etc/docker/certs.d/yourdomain.com/
cp ca.crt /etc/docker/certs.d/yourdomain.com/
```

--------------------------------

### Configure Openstack Swift Storage Backend

Source: https://goharbor.io/docs/2.14.0/install-config/configure-yml-file

Example configuration for using Openstack Swift as the storage provider for the Harbor registry.

```yaml
storage_service:
  ca_bundle:
  swift:
    username: admin
    password: ADMIN_PASS
    authurl: http://keystone_addr:35357/v3/auth
    tenant: admin
    domain: default
    region: regionOne
    container: docker_images
  redirect:
    disabled: false
```

--------------------------------

### GET /api/v2.0/configurations

Source: https://goharbor.io/docs/2.14.0/install-config/configure-system-settings-cli

Retrieves the current system configuration settings for the Harbor instance.

```APIDOC
## GET /api/v2.0/configurations

### Description
Retrieves the current system configuration settings.

### Method
GET

### Endpoint
<Harbor Server URL>/api/v2.0/configurations
```

--------------------------------

### Restart Harbor

Source: https://goharbor.io/docs/2.14.0/install-config/reconfigure-manage-lifecycle

Starts all stopped Harbor containers.

```bash
sudo docker compose start
```

--------------------------------

### Install Harbor with Helm 3

Source: https://goharbor.io/docs/2.14.0/install-config/harbor-ha-helm

Use this command to deploy the Harbor chart when using the Helm 3 package manager.

```bash
helm install my-release harbor/
```

--------------------------------

### Restart Harbor Service

Source: https://goharbor.io/docs/2.14.0/administration/upgrade/roll-back-upgrade

Executes the installation script to restart the restored Harbor instance.

```bash
cd harbor
./install.sh
```

--------------------------------

### Install Harbor with Helm 2

Source: https://goharbor.io/docs/2.14.0/install-config/harbor-ha-helm

Use this command to deploy the Harbor chart when using the Helm 2 package manager.

```bash
helm install --name my-release harbor/
```

--------------------------------

### Restart Harbor Services

Source: https://goharbor.io/docs/2.14.0/install-config/customize-token-service

Starts the Harbor containers using Docker Compose to apply the new configuration.

```bash
docker compose up -d
```

--------------------------------

### Docker Certificate Directory Structure

Source: https://goharbor.io/docs/2.14.0/install-config/configure-https

Example directory layout for custom certificates within the Docker configuration path.

```text
/etc/docker/certs.d/
    └── yourdomain.com:port
       ├── yourdomain.com.cert  <-- Server certificate signed by CA
       ├── yourdomain.com.key   <-- Server key signed by CA
       └── ca.crt               <-- Certificate authority that signed the registry certificate
```

--------------------------------

### Trust Certificates on Red Hat/CentOS

Source: https://goharbor.io/docs/2.14.0/install-config/troubleshoot-installation

Install the certificate bundle to the system trust store on Red Hat-based distributions.

```bash
cp yourdomain.com.crt /etc/pki/ca-trust/source/anchors/yourdomain.com.crt
update-ca-trust
```

--------------------------------

### Get current Harbor configuration

Source: https://goharbor.io/docs/2.14.0/install-config/configure-system-settings-cli

Retrieves the current system configuration settings from the Harbor API.

```bash
curl -u "<username>:<password>" -H "Content-Type: application/json" -ki <Harbor Server URL>/api/v2.0/configurations
```

--------------------------------

### OCI Image Index Example

Source: https://goharbor.io/docs/2.14.0/working-with-projects/working-with-images/deleting-artifact

A JSON representation of an OCI image index manifest, showing how parent artifacts reference child manifests.

```json
{
  "schemaVersion": 2,
  "manifests": [
    {
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "size": 7143,
      "digest": "sha256:e692418e4cbaf90ca69d05a66403747baa33ee08806650b51fab815ad7fc331f",
      "platform": {
        "architecture": "ppc64le",
        "os": "linux"
      }
    },
    {
      "mediaType": "application/vnd.oci.image.manifest.v1+json",
      "size": 7682,
      "digest": "sha256:5b0bcabd1ed22e9fb1310cf6c2dec7cdef19f0ad69efa1f392e94a4333501270",
      "platform": {
        "architecture": "amd64",
        "os": "linux"
      }
    }
  ],
  "annotations": {
    "com.example.key1": "value1",
    "com.example.key2": "value2"
  }
}
```

--------------------------------

### Verify Read-Only Mode Error

Source: https://goharbor.io/docs/2.14.0/administration/general-settings

Example output when attempting to push an image to a Harbor registry configured in read-only mode.

```text
docker push 10.117.169.182/demo/ubuntu:14.04
The push refers to a repository [10.117.169.182/demo/ubuntu]
0271b8eebde3: Preparing 
denied: The system is in read only mode. Any modification is prohibited.
```

--------------------------------

### Slack Webhook Notification Format

Source: https://goharbor.io/docs/2.14.0/working-with-projects/project-configuration/configure-webhooks

Example of the rich text format received when using a Slack incoming webhook URL.

```text
Harbor webhook events
event_type: PUSH_ARTIFACT
occur_at: April 15th at 11:59 AM
operator: admin
event_data:
{
    "resources": [
        {
            "digest": "sha256:8a9e9863dbb6e10edb5adfe917c00da84e1700fa76e7ed02476aa6e6fb8ee0d8",
            "tag": "latest",
            "resource_url": "hub.harbor.com/test-webhook/debian:latest"
        }
    ],
    "repository": {
        "date_created": 1586922308,
        "name": "debian",
        "namespace": "test-webhook",
        "repo_full_name": "test-webhook/debian",
        "repo_type": "private"
    }
}
```

--------------------------------

### Set Harbor Configuration via Environment Variable

Source: https://goharbor.io/docs/2.14.0/install-config/configure-system-settings-cli

Example of the JSON structure used for the CONFIG_OVERWRITE_JSON environment variable to define LDAP settings.

```bash
CONFIG_OVERWRITE_JSON={"ldap_verify_cert":"false", "auth_mode":"ldap_auth","ldap_base_dn":"dc=example,dc=com", "ldap_search_dn":"cn=admin,dc=example,dc=com","ldap_search_password":"admin","ldap_url":"myldap.example.com", "ldap_scope":2}
```

--------------------------------

### Configure Harbor

Source: https://goharbor.io/docs/2.14.0/build-customize-contribute/compile-guide

Navigate to the source directory and prepare the configuration file.

```bash
cd harbor
vi make/harbor.yml
```

--------------------------------

### Package offline installer

Source: https://goharbor.io/docs/2.14.0/build-customize-contribute/use-make

Generates the offline installation package for Harbor.

```bash
make package_offline
```

--------------------------------

### Prepare Harbor Configuration

Source: https://goharbor.io/docs/2.14.0/install-config/reconfigure-manage-lifecycle

Populates configuration files based on the current harbor.yml settings.

```bash
sudo ./prepare
```

```bash
sudo ./prepare --with-trivy
```

--------------------------------

### Prepare Local Golang Environment

Source: https://goharbor.io/docs/2.14.0/build-customize-contribute/compile-guide

Move the source code into the GOPATH directory structure.

```bash
mkdir $GOPATH/src/github.com/goharbor/
cd ..
mv harbor $GOPATH/src/github.com/goharbor/.
```

--------------------------------

### Build and tag a Docker image

Source: https://goharbor.io/docs/2.14.0/install-config/demo-server

Build the image from the Dockerfile and tag it for the demo server registry.

```bash
docker build -t demo.goharbor.io/your-project/test-image .
```

--------------------------------

### GET /robots

Source: https://goharbor.io/docs/2.14.0/administration/robot-accounts

List all robot accounts.

```APIDOC
## GET /robots

### Description
List all robot accounts.

### Method
GET

### Endpoint
/robots
```

--------------------------------

### Copy Proxy Configuration

Source: https://goharbor.io/docs/2.14.0/build-customize-contribute/ui-contribution-get-started

Initializes the proxy configuration file by copying the template.

```bash
cd harbor/src/portal
cp proxy.config.mjs.temp proxy.config.mjs
```

--------------------------------

### GET /robots/{robot_id}

Source: https://goharbor.io/docs/2.14.0/administration/robot-accounts

Read details of a specific robot account.

```APIDOC
## GET /robots/{robot_id}

### Description
Read details of a specific robot account.

### Method
GET

### Endpoint
/robots/{robot_id}

### Parameters
#### Path Parameters
- **robot_id** (string) - Required - The ID of the robot account.
```

--------------------------------

### Build Harbor with Local Golang Environment

Source: https://goharbor.io/docs/2.14.0/build-customize-contribute/compile-guide

Compile and run Harbor using the local Go environment.

```bash
cd $GOPATH/src/github.com/goharbor/harbor
$ make install
```

--------------------------------

### Log in to the Harbor demo server

Source: https://goharbor.io/docs/2.14.0/install-config/demo-server

Authenticate your Docker client with the demo server using your created credentials.

```bash
docker login demo.goharbor.io
```

--------------------------------

### Extract Installer Package

Source: https://goharbor.io/docs/2.14.0/install-config/download-installer

Extract the contents of the downloaded tarball using the tar utility.

```bash
bash $ tar xzvf harbor-online-installer-version.tgz
```

```bash
bash $ tar xzvf harbor-offline-installer-version.tgz
```

--------------------------------

### Create a Dockerfile

Source: https://goharbor.io/docs/2.14.0/install-config/demo-server

Define a minimal Docker image for testing purposes.

```dockerfile
FROM busybox:latest
```

--------------------------------

### Load Offline Migration Image

Source: https://goharbor.io/docs/2.14.0/administration/upgrade

Loads the migration image from the offline installer package tarball.

```bash
tar zxf <offline package>
docker image load -i harbor/harbor.[version].tar.gz
```

--------------------------------

### Check Clair logs

Source: https://goharbor.io/docs/2.14.0/administration/vulnerability-scanning/import-vulnerability-data

Example of log output indicating successful vulnerability database updates.

```text
Jul 3 20:40:45 172.18.0.1 clair[3516]: {"Event":"finished fetching","Level":"info","Location":"updater.go:227","Time":"2017-07-04 03:40:45.890364","updater name":"rhel"}
Jul 3 20:40:46 172.18.0.1 clair[3516]: {"Event":"finished fetching","Level":"info","Location":"updater.go:227","Time":"2017-07-04 03:40:46.768924","updater name":"alpine"}
Jul 3 20:40:47 172.18.0.1 clair[3516]: {"Event":"finished fetching","Level":"info","Location":"updater.go:227","Time":"2017-07-04 03:40:47.190982","updater name":"oracle"}
Jul 3 20:41:07 172.18.0.1 clair[3516]: {"Event":"Debian buster is not mapped to any version number (eg. Jessie-\u003e8). Please update me.","Level":"warning","Location":"debian.go:128","Time":"2017-07-04 03:41:07.833720"}
Jul 3 20:41:07 172.18.0.1 clair[3516]: {"Event":"finished fetching","Level":"info","Location":"updater.go:227","Time":"2017-07-04 03:41:07.833975","updater name":"debian"}
Jul 4 00:26:17 172.18.0.1 clair[3516]: {"Event":"finished fetching","Level":"info","Location":"updater.go:227","Time":"2017-07-04 07:26:17.596986","updater name":"ubuntu"}
Jul 4 00:26:18 172.18.0.1 clair[3516]: {"Event":"adding metadata to vulnerabilities","Level":"info","Location":"updater.go:253","Time":"2017-07-04 07:26:18.060810"}
Jul 4 00:38:05 172.18.0.1 clair[3516]: {"Event":"update finished","Level":"info","Location":"updater.go:198","Time":"2017-07-04 07:38:05.251580"}
```

--------------------------------

### Execute Helm Upgrade

Source: https://goharbor.io/docs/2.14.0/administration/upgrade/helm-upgrade

Perform the Harbor upgrade using the Helm chart.

```bash
helm upgrade release-name --force .
```

--------------------------------

### Download Harbor Helm Chart

Source: https://goharbor.io/docs/2.14.0/install-config/harbor-ha-helm

Commands to add the Harbor repository and download the chart locally.

```bash
helm repo add harbor https://helm.goharbor.io
helm fetch harbor/harbor --untar
```

--------------------------------

### Create and Package OCI Charts

Source: https://goharbor.io/docs/2.14.0/working-with-projects/working-with-oci/working-with-helm-oci-charts

Commands to initialize, package, and push a new Helm chart to a Harbor registry.

```bash
helm create oci-chart-example
```

```bash
helm package oci-chart-example
```

```bash
helm push oci-chart-example-0.1.0.tgz oci://demo.goharbor.io/oci-charts
```

--------------------------------

### Import Harbor Public GPG Key

Source: https://goharbor.io/docs/2.14.0/install-config/download-installer

Retrieve the public key required to verify the authenticity of the Harbor installer bundle.

```bash
gpg --keyserver hkps://keyserver.ubuntu.com --receive-keys 644FF454C0B4115C
```

--------------------------------

### Display Pod information with placeholders

Source: https://goharbor.io/docs/2.14.0/build-customize-contribute/style-guide

Use angle brackets to denote placeholders for user-supplied values in command-line instructions.

```bash
 kubectl describe pod <pod-name> -n <namespace>
```

--------------------------------

### Copy Certificates to Harbor

Source: https://goharbor.io/docs/2.14.0/install-config/configure-https

Move the server certificate and key files to the Harbor host directory.

```bash
cp yourdomain.com.crt /data/cert/
cp yourdomain.com.key /data/cert/
```

--------------------------------

### Push the Docker image

Source: https://goharbor.io/docs/2.14.0/install-config/demo-server

Upload the tagged image to your project repository on the demo server.

```bash
docker push demo.goharbor.io/your-project/test-image
```

--------------------------------

### Docker connection error message

Source: https://goharbor.io/docs/2.14.0/working-with-projects/working-with-images/pulling-pushing-images

Example of the error message displayed when the Docker client fails to connect to a registry due to configuration issues.

```text
Error response from daemon: Get https://_myregistrydomain.com_/v1/users/: dial tcp _myregistrydomain.com_:443 getsockopt: connection refused.
```

--------------------------------

### Migrate Harbor Configuration

Source: https://goharbor.io/docs/2.14.0/administration/upgrade

Runs the migration tool to update the existing harbor.yml file to the new version format.

```bash
docker run -it --rm -v /:/hostfs goharbor/prepare:[tag] migrate -i ${path to harbor.yml}
```

--------------------------------

### Clone Harbor Source Code

Source: https://goharbor.io/docs/2.14.0/build-customize-contribute/compile-guide

Download the Harbor repository from GitHub.

```bash
git clone https://github.com/goharbor/harbor
```

--------------------------------

### Define a User-defined OCI Artifact Manifest

Source: https://goharbor.io/docs/2.14.0/administration/user-defined-oci-artifact

Example of an OCI manifest configured with Harbor-specific annotations for skipping configuration keys and defining an icon layer.

```json
{
    "schemaVersion": 2,
    "config": {
        "mediaType": "application/vnd.caicloud.model.config.v1alpha1+json",
        "digest": "sha256:be948daf0e22f264ea70b713ea0db35050ae659c185706aa2fad74834455fe8c",
        "size": 187,
        "annotations": {
            "io.goharbor.artifact.v1alpha1.skip-list": "metrics,git"
        }
    },
    "layers": [
        {
            "mediaType": "image/png",
            "digest": "sha256:d923b93eadde0af5c639a972710a4d919066aba5d0dfbf4b9385099f70272da0",
            "size": 166015,
            "annotations": {
                "io.goharbor.artifact.v1alpha1.icon": ""
            }
        },
        {
            "mediaType": "application/tar+gzip",
            "digest": "sha256:d923b93eadde0af5c639a972710a4d919066aba5d0dfbf4b9385099f70272da0",
            "size": 166015
        }
    ]
}
```

--------------------------------

### Log in and Push Images to Harbor

Source: https://goharbor.io/docs/2.14.0/install-config/run-installer-script

Authenticates with the Harbor registry and pushes a tagged image.

```bash
docker login reg.yourdomain.com
docker push reg.yourdomain.com/myproject/myrepo:mytag
```

--------------------------------

### Edit Harbor Configuration

Source: https://goharbor.io/docs/2.14.0/install-config/reconfigure-manage-lifecycle

Opens the configuration file for modification.

```bash
vim harbor.yml
```

--------------------------------

### Generate an x509 v3 extension file

Source: https://goharbor.io/docs/2.14.0/install-config/configure-https

Creates a configuration file to satisfy Subject Alternative Name (SAN) and x509 v3 requirements. Update the DNS entries to match your specific domain or hostname.

```bash
cat > v3.ext <<-EOF
authorityKeyIdentifier=keyid,issuer
basicConstraints=CA:FALSE
keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1=yourdomain.com
DNS.2=yourdomain
DNS.3=hostname
EOF

```

--------------------------------

### Authenticate to Harbor Registry

Source: https://goharbor.io/docs/2.14.0/working-with-projects/working-with-images/sign-images

Set environment variables to authenticate the Notation CLI with the Harbor registry.

```bash
export NOTATION_USERNAME="YOUR_REGISTRY_USERNAME"
export NOTATION_PASSWORD="YOUR_REGISTRY_PASSWORD"
```

--------------------------------

### Create and Import Trust Policy

Source: https://goharbor.io/docs/2.14.0/working-with-projects/working-with-images/sign-images

Define a trust policy in a JSON file and import it into the Notation configuration.

```bash
cat <<EOF > ./trustpolicy.json
{
    "version": "1.0",
    "trustPolicies": [
        {
            "name": "wabbit-networks-images",
            "registryScopes": [ "*" ],
            "signatureVerification": {
                "level" : "strict"
            },
            "trustStores": [ "ca:wabbit-networks.io" ],
            "trustedIdentities": [
                "*"
            ]
        }
    ]
}
EOF
```

```bash
notation policy import ./trustpolicy.json
```

--------------------------------

### Execute Harbor Backup with Velero

Source: https://goharbor.io/docs/2.14.0/administration/backup-restore

Commands to trigger a Harbor backup using different Velero snapshot and file system backup methods.

```bash
# replace the namespace and backup name with yours
velero backup create harbor-backup --include-namespaces harbor --snapshot-volumes --wait
```

```bash
# replace the namespace and backup name with yours
velero backup create harbor-backup --include-namespaces harbor --snapshot-volumes --snapshot-move-data --wait
```

```bash
# replace the namespace and backup name with yours
velero backup create harbor-backup --include-namespaces harbor --default-volumes-to-fs-backup --wait
```
Tokens:
Raw