{
 "slug": "harbor",
 "name": "Harbor",
 "tagline": "Container registry with vulnerability scanning, image signing and RBAC",
 "category": "developer-platform",
 "use_cases": [
  "container-registry",
  "image-scanning",
  "oci-artifacts"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Harbor (CNCF)",
  "url": "https://goharbor.io",
  "license": "Apache-2.0",
  "license_url": "https://github.com/goharbor/harbor/blob/main/LICENSE"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "2.15.4",
   "last_build": "2026-10-24",
   "entity_id": "prod-m4v4xtqe6iqr6",
   "ami_alias": "/aws/service/marketplace/prod-m4v4xtqe6iqr6/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-lu2mmvd7gc27k",
   "recommended_instance_type": "m6i.xlarge",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "2.15.2",
   "last_build": "2026-07-11",
   "offer_id": "harbor",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:harbor:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.harbor?tab=Overview",
   "recommended_vm_size": "Standard_D4s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/harbor/",
  "json": "https://lynxroute.com/products/harbor/product.json"
 },
 "release_notes": [
  {
   "version": "2.15.4",
   "title": "Harbor 2.15.4",
   "notes": "* Harbor updated 2.15.2 -> 2.15.4 (includes 2.15.3), a security patch release. Apache-2.0 unchanged\n* Security: fixes four high-severity advisories (path traversal in distribution endpoints, robot-account and auth-proxy privilege escalation to system administrator) plus SSRF in webhook delivery and the replication client, an immutable-tag rule bypass and a User-Agent based pull-policy bypass\n* Webhooks to private addresses and legacy cosign/notation signer pulls stay allowed by default, as in 2.15.2; both can now be switched off in harbor.yml\n* Fixes push replication to AWS ECR, adds size limits for manifest uploads and audit-log payloads, and bundles Trivy 0.75.0 with Trivy adapter 0.39.1\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-24"
   }
  },
  {
   "version": "2.15.2",
   "title": "Harbor v-2.15.2",
   "notes": "* Re-release of Harbor 2.15.2. The application version is unchanged; this build refreshes the underlying operating system image\n* Certbot pre-installed - enable HTTPS with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-04",
    "azure": "2026-07-11"
   }
  },
  {
   "version": "2.15.2",
   "title": "Harbor 2.15.2 - July 2026",
   "notes": "* Harbor 2.15.2 on Ubuntu 24.04 LTS - version bump from 2.15.1 (bug fixes and security patches)\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n* CVE-scanned before every release\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-04",
    "azure": "2026-07-11"
   }
  },
  {
   "version": "2.15.1",
   "title": "Harbor 2.15.1 - Initial release (June 2026)",
   "notes": "* Harbor 2.15.1 on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Unique admin password generated at first launch (built-in admin user)\n* HTTPS enabled automatically with a self-signed certificate (public-IP SAN) for immediate Docker push/pull\n* Bundled Trivy vulnerability scanner; registry, PostgreSQL and Redis kept behind the host TLS edge\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-07-01",
    "azure": "2026-06-29"
   }
  }
 ],
 "release_history": [
  {
   "version": "2.15.4",
   "aws": "2026-10-24"
  },
  {
   "version": "2.15.2",
   "aws": "2026-09-04",
   "azure": "2026-07-11"
  },
  {
   "version": "2.15.1",
   "aws": "2026-07-01",
   "azure": "2026-06-29"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-m4v4xtqe6iqr6/latest \\\n  --instance-type m6i.xlarge --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer harbor --plan payg-gen2\naz vm create -g my-rg -n harbor --size Standard_D4s_v3 \\\n  --image lynxroute:harbor:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Harbor is an open-source, CNCF-graduated container registry for storing, scanning, and serving OCI images and Helm charts. It runs as a multi-service stack - registry, API core, job service, PostgreSQL, Redis, and a bundled Trivy scanner - orchestrated with Docker Compose. On top of the OCI Distribution registry, Harbor adds built-in vulnerability scanning with Trivy, content trust and image signing (Cosign), role-based access control with projects and robot accounts, tag retention and immutability rules, storage quotas, webhooks, and pull-through proxy caching plus replication to and from other registries. Images and metadata persist in PostgreSQL and on the local filesystem under /data. Harbor is governed by the Cloud Native Computing Foundation under the Apache-2.0 license, with no open-core feature gating and no vendor lock-in.",
  "image_adds": "Security hardening:\n* Unique admin password generated at first launch (built-in admin user), written to /root/harbor-credentials.txt\n* HTTPS enabled automatically at first launch with a self-signed certificate carrying the instance public IP, so Docker push and pull work immediately\n* Registry, PostgreSQL, Redis, and the Trivy adapter run behind the host TLS edge; only HTTP/HTTPS are exposed\n* UFW firewall pre-configured (ports 22, 80, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}