Harbor is an open-source OCI artifact registry that secures software supply chains with vulnerability scanning, signing, and access control.
Launch in your Sealos workspace.
Start with the resources defined by the Harbor template. Review CPU, memory, persistent storage, and network allocations for every service in Canvas. Capacity needs depend on your data and workload; monitor usage as they grow.
Template configuration and setupUse the application URL or connection details shown in Canvas. Follow the deployment guide for first-time account setup or client configuration, and keep generated credentials available for that step.
Sealos monthly plans include compute, memory, storage, and traffic. Size your plan for all deployed services. Software licenses and external AI or API services may have separate terms and charges. Confirm the applicable plan and optional charges in Cost Center.
Compare Sealos resource plansFor current cloud charges, refer to Sealos plan pricing. Upstream documentation may reference earlier billing models.
Harbor is an open-source OCI artifact registry with role-based access control, vulnerability scanning, replication, and artifact governance. This template deploys Harbor v2.15.2 with KubeBlocks-managed PostgreSQL and Redis, plus a choice of Sealos S3-compatible object storage or a Registry persistent volume.
Harbor stores and distributes container images, Helm charts, SBOMs, signatures, and other OCI artifacts. Projects provide access boundaries for teams, while robot accounts and retention, replication, and scanning policies support automated delivery pipelines.
The template preserves Harbor's multi-service architecture with separate core, portal, jobservice, registry, registryctl, and trivy workloads. KubeBlocks provisions PostgreSQL 16.4 for metadata and Redis 7.2.7 with Sentinel for queues and cache state.
One HTTPS domain serves the web interface and registry API. The root path reaches the portal, while /api/, /service/, /v2/, and /c/ reach Harbor Core.
The template provisions the complete runtime:
Architecture components:
goharbor/harbor-core:v2.15.2): Authentication, API, token service, and control-plane logicgoharbor/harbor-portal:v2.15.2): Web interfacegoharbor/harbor-jobservice:v2.15.2): Scan, replication, retention, and garbage-collection jobsgoharbor/registry-photon:v2.15.2): OCI distribution servicegoharbor/harbor-registryctl:v2.15.2): Registry configuration and health controlgoharbor/trivy-adapter-photon:v2.15.2): Vulnerability scanningVerified minimum resource envelope:
| Component | CPU limit | Memory limit | Persistent storage |
|---|---|---|---|
| Each Harbor service | 100m | 128 MiB | Service-dependent |
| PostgreSQL | 500m | 512 MiB | 1 GiB |
| Redis | 500m | 512 MiB | 1 GiB |
| Redis Sentinel | 500m | 512 MiB | 1 GiB |
| Jobservice logs | Included above | Included above | 1 GiB |
| Trivy reports | Included above | Included above | 1 GiB |
Trivy also reserves 2 GiB of ephemeral storage for its vulnerability database. The first scan after a Trivy Pod replacement downloads this database and can take longer. The minimum envelope passed idle startup, authenticated UI use, image push and pull, Pod recreation, and vulnerability scanning; production traffic and larger repositories usually require additional CPU, memory, and storage.
License information:
Harbor is licensed under the Apache License 2.0.
Sealos is an AI-assisted Cloud Operating System built on Kubernetes. A Harbor deployment on Sealos provides:
harbor_admin_password: Set the initial password for the built-in admin account. Use at least 8 characters and store it securely.enable_s3_storage: Keep the default value true for a private Sealos ObjectStorageBucket. Select false for a 1 GiB Registry persistent volume.admin and the harbor_admin_password value.Public self-registration is disabled by default. An administrator can create users from Administration > Users, and each project can create robot accounts for automated clients.
Harbor reads harbor_admin_password during the initial database setup. For an existing deployment, change the password from the admin profile or follow the official password reset procedure.
Create a project in the Harbor UI, then run:
export HARBOR_HOST="<your-harbor-domain>"
docker login "$HARBOR_HOST" -u admin
docker pull busybox:1.37.0
docker tag busybox:1.37.0 "$HARBOR_HOST/<project>/busybox:1.37.0"
docker push "$HARBOR_HOST/<project>/busybox:1.37.0"
docker pull "$HARBOR_HOST/<project>/busybox:1.37.0"
Enter the deployment password at the docker login prompt. For CI/CD, create a project robot account and use its generated credentials.
| Parameter | Description | Required | Default |
|---|---|---|---|
harbor_admin_password | Initial password for the built-in admin account | Yes | None |
enable_s3_storage | Select private Sealos object storage (true) or the Registry PVC (false) | No | true |
| Mode | Artifact backend | Recommended use |
|---|---|---|
| S3 enabled | Private Sealos ObjectStorageBucket | Durable registries and growing artifact collections |
| S3 disabled | 1 GiB Registry PVC | Small registries, development, and local storage workflows |
Choose the storage mode before the first image push. A later mode change requires a separate artifact migration. Increase the Registry PVC capacity in Canvas before storing artifact sets that approach 1 GiB.
After deployment, use:
The template starts each Harbor workload with one replica and preserves the original component boundaries. Increase resources from Canvas based on observed demand:
Review Harbor's high-availability architecture before changing replica counts because several components require shared storage and coordinated configuration.
admin.This Sealos template follows the templates repository license policy. Harbor is licensed under the Apache License 2.0.
A shorter path from an app you want to an app you can run. Sealos brings deployment and ongoing operations into one place.
Start with a ready-made template. Review its configuration and launch from the Sealos console.
Run on managed infrastructure with built-in workload scheduling and recovery.
Give your application a public HTTPS endpoint with certificates managed for you.
Keep application data on persistent volumes across container restarts.
Adjust CPU, memory, and replicas from the console as your workload changes.
Sealos provisions the resources defined by your template and brings them together in your workspace.
Container workloads with configurable CPU, memory, and replicas.
An address for your app, with managed TLS certificates.
A database provisioned alongside your app when the template calls for one.
Storage for the files and data your application needs to keep.
Application settings and secrets configured in one place.
Inspect container logs and resource usage from the console.
Resources and their configuration vary by template. Review the deployment form for this app’s exact setup.
Explore more production-ready templates.
Build production-ready devops templates with Sealos.
Connect databases, APIs, and SaaS tools to a warehouse with Airbyte. Deploy its integration services, PostgreSQL, and object storage on Sealos.
Build production-ready devops templates with Sealos.
Test AWS-compatible APIs with LocalStack on Sealos. Point your SDK or CLI at the hosted gateway to develop S3, SQS, and other cloud integrations.
Build production-ready devops templates with Sealos.
Host an OCI container registry with Project Quay on Sealos. Store images with PostgreSQL, Redis, persistent storage, and automatic initial administrator setup.