Container registry with vulnerability scanning, image signing and RBAC
CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside
| Cloud | Version | Software price | Last build | |
|---|---|---|---|---|
| AWS Marketplace EC2 AMI · all commercial regions | 2.15.4 | $0.05/hr Recommended instance: m6i.xlarge · 5-day free trial | 2026-10-24 | Listing ↗ |
| Azure Marketplace VM image · plan payg-gen2 · Gen2 | 2.15.2 | $0.028/vCPU/hr Recommended VM: Standard_D4s_v3 | 2026-07-11 | Listing ↗ |
Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.
| Base OS | Ubuntu 24.04 LTS |
| Hardening | CIS Level 1, Ubuntu 24.04 LTS (tailored) |
| License | Apache-2.0 |
| Upstream | Harbor (CNCF) |
| Machine-readable | product.json · catalog.json |
Harbor is an open-source, CNCF-graduated container registry for storing, scanning, and serving OCI images and Helm charts. It runs as a multi-service stack - registry, API core, job service, PostgreSQL, Redis, and a bundled Trivy scanner - orchestrated with Docker Compose. On top of the OCI Distribution registry, Harbor adds built-in vulnerability scanning with Trivy, content trust and image signing (Cosign), role-based access control with projects and robot accounts, tag retention and immutability rules, storage quotas, webhooks, and pull-through proxy caching plus replication to and from other registries. Images and metadata persist in PostgreSQL and on the local filesystem under /data. Harbor is governed by the Cloud Native Computing Foundation under the Apache-2.0 license, with no open-core feature gating and no vendor lock-in.
Security hardening:
OS hardening (CIS Level 1):
Compliance artifacts:
Credentials are generated at first boot and written to /root/harbor-credentials.txt.
# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
--image-id resolve:ssm:/aws/service/marketplace/prod-m4v4xtqe6iqr6/latest \
--instance-type m6i.xlarge --key-name my-key --security-group-ids sg-xxxxxxxx# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer harbor --plan payg-gen2
az vm create -g my-rg -n harbor --size Standard_D4s_v3 \
--image lynxroute:harbor:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
The most recent release with notes; the full release history is in product.json.