# Container Registry > The Artifact Backbone of Your Software Supply Chain. Store, manage and distribute container artifacts securely at scale. 8gears Container Registry is the enterprise Harbor distribution built and operated by Harbor maintainers. This is the agent-facing index for https://container-registry.com/. The markdown representation of any page is reachable by appending `index.md` to its URL (e.g. `/pricing/` becomes `/pricing/index.md`). Prefer the markdown URLs over scraping HTML. ## Documentation Current version: Harbor 2.15. Each version is published under `/docs//`. - [Artifact Types](https://container-registry.com/docs/2.15/user-manual/images/artifact-types/index.md) — What Container Registry stores as an artifact: images, OCI indexes and Helm charts, why an index exists, and how a SHA256 digest identifies each one. - [Configure OIDC Authentication](https://container-registry.com/docs/2.15/administration-manual/authentication-management/user-authentication/oidc-authentication/configure-oidc-authentication/index.md) — Enable OIDC single sign-on in Container Registry: enter the provider endpoint, client credentials and scopes, then verify the callback URL and CLI secret. - [Configure Project Settings](https://container-registry.com/docs/2.15/user-manual/projects/configuration/configure-project-settings/index.md) — Configure a Container Registry project: labels, its vulnerability scanner, public or private access, deployment security and the CVE allowlist. - [Manage System Robot Accounts](https://container-registry.com/docs/2.15/administration-manual/authentication-management/system-robot-accounts/manage-system-robot-accounts/index.md) — Create a system robot account, choose its permissions and projects, refresh its secret, and disable it when the automation no longer needs access. - [New User Sign Up](https://container-registry.com/docs/2.15/getting-started-guide/new-user-sign-up/index.md) — Sign up for Container Registry, reach the subdomain of your own instance, and see which registration methods are open to new users. - [Project Quotas](https://container-registry.com/docs/2.15/administration-manual/storage-management/project-quotas/index.md) — What a project quota covers, how the storage overview reads, and how shared image layers count when an artifact is pushed, retagged or deleted. - [Replication Rules](https://container-registry.com/docs/2.15/administration-manual/replication/replication-rules/index.md) — What a replication rule does: which events trigger it, how layer flattening changes the destination path, and what happens to namespaces and failed tasks. - [What Is Harbor?](https://container-registry.com/docs/2.15/introduction/what-is-harbor/index.md) — Container Registry is built on Harbor, the open-source CNCF registry for storing and managing container images. Here is what that means for you. - [Working With Projects](https://container-registry.com/docs/2.15/user-manual/projects/working-with-projects/index.md) — What projects are for in Container Registry, how public and private projects differ, and how to create, filter, refresh and delete them. - [Database Authentication](https://container-registry.com/docs/2.15/administration-manual/authentication-management/user-authentication/database-authentication/index.md) — Database authentication keeps user accounts inside Container Registry. Activate the mode and decide whether new users may register themselves. - [Registration for System Admins](https://container-registry.com/docs/2.15/administration-manual/authentication-management/registration-for-system-admins/index.md) — Register as the system administrator of a new Container Registry instance, from choosing a subscription to the first sign-in with your password. - [Preheat Images](https://container-registry.com/docs/2.15/user-manual/projects/configuration/preheat-images/index.md) — Preheat images to a P2P network from Container Registry, using filters for repository, tag and label and manual, scheduled or event-based triggers. - [Federated Identity Provider for Workload Authentication](https://container-registry.com/docs/2.15/administration-manual/authentication-management/system-robot-accounts/federated-identity-provider-for-workload-authentication/index.md) — Let CI/CD pipelines and Kubernetes workloads authenticate to Container Registry with short-lived JWTs from your identity provider, not stored secrets. - [Manage Project Quotas](https://container-registry.com/docs/2.15/administration-manual/storage-management/manage-project-quotas/index.md) — Set the default storage quota applied to new projects, and change the quota of a project that already exists, including making it unlimited. - [Manage Replication Rules](https://container-registry.com/docs/2.15/administration-manual/replication/manage-replication-rules/index.md) — Create a replication rule and fill in its form, then run, disable, edit, delete or stop it, and read the logs when a replication fails. - [OIDC configuration for Azure AD](https://container-registry.com/docs/2.15/administration-manual/authentication-management/user-authentication/oidc-authentication/oidc-configuration-for-azure-ad/index.md) — Set up Azure Active Directory as the OIDC provider for Container Registry: register the application in Azure, then enter the endpoint and client secret. - [Push and Pull Images](https://container-registry.com/docs/2.15/getting-started-guide/push-and-pull-images/index.md) — Log in with Docker, tag an image for your Container Registry project, push it, and pull it back by tag or digest. The first thing to try. - [Repositories](https://container-registry.com/docs/2.15/user-manual/projects/repositories/index.md) — Repositories are the folders inside a Container Registry project. Open one by pull URL, browse the list or card view, and manage its artifacts. - [Tag Retention](https://container-registry.com/docs/2.15/user-manual/images/tags/tag-retention/index.md) — Save storage by defining tag retention rules that keep only the artifacts you need, then run them by hand or on a schedule for each repository. - [The Artifact List](https://container-registry.com/docs/2.15/user-manual/images/the-artifact-list/index.md) — Reference for the artifact overview table: the pull command, tags, size, vulnerability count and annotations shown for every artifact in a repository. - [Why Use Container Registry](https://container-registry.com/docs/2.15/introduction/why-use-container-registry/index.md) — Why run a container registry as a service: control of your images, no pull rate limits, vulnerability scanning and replication without operating Harbor. - [Manage Pre-Installed Scanners](https://container-registry.com/docs/2.15/administration-manual/scanners/manage-pre-installed-scanners/index.md) — Set the default vulnerability scanner for your Container Registry instance, edit the details of a scanner, and disable or delete the unused ones. - [Container Registry User Interface: A Short Overview](https://container-registry.com/docs/2.15/user-manual/container-registry-user-interface-a-short-overview/index.md) — A tour of the Container Registry web console: what a user sees, what an administrator sees in addition, and where to find your own CLI secret. - [Filter and Manage Artifacts](https://container-registry.com/docs/2.15/user-manual/images/filter-and-manage-artifacts/index.md) — Filter artifacts by type, tag or label in a repository, copy a digest, add labels, and delete or scan several artifacts in one bulk action. - [Garbage Collection and Terminal Deletion of Images](https://container-registry.com/docs/2.15/administration-manual/storage-management/garbage-collection-and-terminal-deletion-of-images/index.md) — Run or schedule garbage collection to reclaim the disk space deleted images still occupy, and read the log to confirm what was actually removed. - [How LDAP/AD Authentication Works](https://container-registry.com/docs/2.15/administration-manual/authentication-management/user-authentication/how-ldap-ad-authentication-works/index.md) — Why Container Registry delegates user identity to an LDAP or Active Directory server, what that mode cannot do, and how LDAP groups map onto it. - [Manage Project Users](https://container-registry.com/docs/2.15/user-manual/projects/manage-project-users/index.md) — Add members to a Container Registry project one by one or through LDAP and OIDC groups, change their role, and remove them when they leave. - [OIDC configuration for Google Workspaces](https://container-registry.com/docs/2.15/administration-manual/authentication-management/user-authentication/oidc-authentication/oidc-configuration-for-google-workspaces/index.md) — Set up Google Workspace as the OIDC provider for Container Registry: create the Google Cloud project, consent screen and credentials, then connect them. - [Prerequisites](https://container-registry.com/docs/2.15/introduction/prerequisites/index.md) — The only prerequisite for Container Registry is an OCI compliant runtime such as Docker or Podman. Check the system and browser requirements here. - [Project Robot Accounts](https://container-registry.com/docs/2.15/user-manual/projects/configuration/project-robot-accounts/index.md) — Create a robot account that reaches one Container Registry project through the API, set what it may do, and refresh or replace its secret. - [Tag Immutability](https://container-registry.com/docs/2.15/user-manual/images/tags/tag-immutability/index.md) — Stop a tag being overwritten in a Container Registry project by creating an immutability policy, and manage the rules once they are in place. - [Add New Scanners](https://container-registry.com/docs/2.15/administration-manual/scanners/add-new-scanners/index.md) — Add a vulnerability scanner to Container Registry: give it an endpoint, choose the authorization method, and decide on certificate verification. - [Endpoints For Replications and Proxy Cache](https://container-registry.com/docs/2.15/administration-manual/replication/endpoints-for-replications-and-proxy-cache/index.md) — Create the endpoint a replication rule or proxy cache project points at, whether it is another Harbor instance or a registry from another provider. - [User Management](https://container-registry.com/docs/2.15/administration-manual/authentication-management/user-management/index.md) — Add and remove Container Registry users in database mode, grant or revoke system administrator rights, and reset the password of a user who lost it. - [Working With Helm Charts and OCI Registries](https://container-registry.com/docs/2.15/getting-started-guide/working-with-helm-charts-and-oci-registries/index.md) — Push and install Helm charts through the OCI registry in Container Registry, and see how that compares with a ChartMuseum chart repository. - [Artifact Page](https://container-registry.com/docs/2.15/user-manual/images/artifact-page/index.md) — Reference for the Container Registry artifact page: tags, general information, vulnerability findings and the build history of a single artifact. - [Configure LDAP/AD Authentication](https://container-registry.com/docs/2.15/administration-manual/authentication-management/user-authentication/configure-ldap-ad-authentication/index.md) — Point Container Registry at an LDAP or Active Directory server: the values you need, the steps in the GUI, and the group settings that go with them. - [Database Observability](https://container-registry.com/docs/2.15/administration-manual/storage-management/database-observability/index.md) — Turn on OpenTelemetry query tracing and connection pool metrics for the PostgreSQL layer with one environment variable, and read them at /metrics. - [Dedicated vs Individual Account](https://container-registry.com/docs/2.15/introduction/dedicated-vs-individual-account/index.md) — Compare the individual, dedicated and enterprise Container Registry plans on users and RBAC, storage, customization and the features each includes. - [Project Member Permissions](https://container-registry.com/docs/2.15/user-manual/projects/project-member-permissions/index.md) — Reference of what each project role may do in Container Registry: limited guest, guest, developer, maintainer and project administrator, action by action. - [Scanning Artifacts](https://container-registry.com/docs/2.15/administration-manual/scanners/scanning-artifacts/index.md) — Run a vulnerability scan across your Container Registry instance on demand or on a schedule, and see which artifact types the scanner accepts. - [Webhooks](https://container-registry.com/docs/2.15/user-manual/projects/configuration/webhooks/index.md) — What a Container Registry webhook sends: the JSON payload, and every event type from artifact push through quota warnings to replication finishing. - [Proxy Cache Projects](https://container-registry.com/docs/2.15/administration-manual/replication/proxy-cache-projects/index.md) — Set up a proxy cache project so Container Registry serves images held on Docker Hub and other registries, avoiding pull rate limits and outages. - [Other Useful Features](https://container-registry.com/docs/2.15/getting-started-guide/other-useful-features/index.md) — What Container Registry offers beyond pushing and pulling: proxy cache, replication, vulnerability scanning, retention rules, webhooks and quotas. - [Enable Webhooks](https://container-registry.com/docs/2.15/user-manual/projects/configuration/enable-webhooks/index.md) — Add a webhook to a Container Registry project so an HTTP endpoint or a Slack channel is notified whenever an artifact event occurs in it. - [Manage the System-Wide CVE Allowlist](https://container-registry.com/docs/2.15/administration-manual/scanners/manage-the-system-wide-cve-allowlist/index.md) — Exclude specific CVEs from the health score across the whole instance by adding them to the system-wide allowlist, with an expiry date if you need one. - [Push and Pull Images](https://container-registry.com/docs/2.15/user-manual/images/push-and-pull-images/index.md) — Pushing and pulling images is covered in the getting started guide, which walks through Docker login, tagging, pushing and pulling an image. - [Supported Non-Harbor Registries](https://container-registry.com/docs/2.15/administration-manual/replication/supported-non-harbor-registries/index.md) — Which third-party registries Container Registry can replicate to and from, and which of them a proxy cache project can pull through. - [AWS RDS IAM Authentication for PostgreSQL](https://container-registry.com/docs/2.15/administration-manual/authentication-management/user-authentication/aws-rds-iam-authentication-for-postgresql/index.md) — Connect Container Registry to PostgreSQL with AWS RDS IAM authentication, so backend services use short-lived IAM tokens instead of a static password. - [P2P Preheat distribution](https://container-registry.com/docs/2.15/administration-manual/replication/p2p-preheat-distribution/index.md) — Register a Dragonfly or Kraken distribution provider instance so projects can preheat images to a P2P network. The system administrator adds the instance; the project manager then uses it in a P2P Preheat policy. - [UAA Authentication](https://container-registry.com/docs/2.15/administration-manual/authentication-management/user-authentication/uaa-authentication/index.md) — Point Container Registry at a UAA server so it issues the access tokens for user authentication, and see how non-admin users reach the command line. - [Working With Logs](https://container-registry.com/docs/2.15/user-manual/working-with-logs/index.md) — Read the Container Registry event logs at instance and project level to see who pushed, pulled or deleted an artifact, and when it happened. - [Working With Tags](https://container-registry.com/docs/2.15/user-manual/images/working-with-tags/index.md) — Add, retag and remove image tags in Container Registry, and see how a tag points to a state of an artifact the way a branch ref does in Git. - [Authenticating a Workload with Federated Identity](https://container-registry.com/docs/2.15/user-manual/images/authenticating-a-workload-with-federated-identity/index.md) — Authenticate a CI/CD pipeline or Kubernetes workload to Container Registry with a short-lived JWT from your identity provider instead of a stored secret. - [System-Wide Labels](https://container-registry.com/docs/2.15/administration-manual/other-system-settings/system-wide-labels/index.md) — Create labels that every project in the Container Registry instance can attach to artifacts, and edit or delete them once they are no longer used. - [Filtering Rules Syntax](https://container-registry.com/docs/2.15/user-manual/filtering-rules-syntax/index.md) — How to write pattern filters in Container Registry: single and double stars, the question mark, brace lists, and regular expressions, with an example for each. - [Other System Settings](https://container-registry.com/docs/2.15/administration-manual/other-system-settings/other-system-settings/index.md) — Reference for the Container Registry system settings: project authorship, token expiration, robot name prefix, read-only mode and webhook switches. - [Job Service Dashboard](https://container-registry.com/docs/2.15/administration-manual/other-system-settings/job-service-dashboard/index.md) — Monitor the job queues, schedules, and workers behind Container Registry's asynchronous jobs, and act on stuck work: stop queued jobs, pause queues, or free a worker. - [Product Branding](https://container-registry.com/docs/2.15/administration-manual/other-system-settings/product-branding/index.md) — White-label the Container Registry interface with your own product name, logo, colors and login page, through the portal or the branding API. - [Harbor v2.15.8](https://container-registry.com/docs/2.15/release-notes/harbor-v2.15.8/index.md) — Release notes for Container Registry 2.15.8: schema reconciliation backport, ORM savepoint and migration fixes, plus upstream security patches. - [Harbor v2.15.7](https://container-registry.com/docs/2.15/release-notes/harbor-v2.15.7/index.md) — Release notes for Container Registry 2.15.7: proxy-cache filter hardening, credential-exfiltration and redis-log fixes, plus upstream security patches. - [Harbor v2.15.6](https://container-registry.com/docs/2.15/release-notes/harbor-v2.15.6/index.md) — Release notes for Container Registry 2.15.6: idempotent vulnerability-report persistence, plus quota-query and dependency fixes from upstream Harbor. - [Harbor v2.15.5](https://container-registry.com/docs/2.15/release-notes/harbor-v2.15.5/index.md) — Release notes for Container Registry 2.15.5: SBOM accessory push and audit-event fixes, with eleven changes cherry-picked from upstream Harbor. - [Harbor v2.15.4](https://container-registry.com/docs/2.15/release-notes/harbor-v2.15.4/index.md) — Release notes for Container Registry 2.15.4: a zero-CVE pipeline and Go quality linters, with proxy-cache goroutine bounds and artifact-scan caching fixes. - [Harbor v2.15.3](https://container-registry.com/docs/2.15/release-notes/harbor-v2.15.3/index.md) — Release notes for Container Registry 2.15.3: an LDAP login fix, correct 404s for missing artifacts, quieter auth-failure logs and invalid UTF-8 handling. - [Harbor v2.15.2](https://container-registry.com/docs/2.15/release-notes/harbor-v2.15.2/index.md) — Release notes for Container Registry 2.15.2: cache eviction and locking corrections, a file-descriptor leak fix, and the restored 2.14.x upgrade migration. - [Harbor v2.15.1](https://container-registry.com/docs/2.15/release-notes/harbor-v2.15.1/index.md) — Release notes for Container Registry 2.15.1: Trivy adapter image naming, categorised release notes, and ten changes cherry-picked from upstream Harbor. - [Harbor v2.15.0](https://container-registry.com/docs/2.15/release-notes/harbor-v2.15.0/index.md) — Release notes for Container Registry 2.15.0: sixteen new features including LDAP admin filters and conditional immutability rules, plus fifty bug fixes. ## Blog posts - [No More Registry Passwords or imagePullSecrets: Keyless Harbor End to End](https://container-registry.com/posts/keyless-harbor-workload-identity-federation/index.md) — Stop storing registry passwords in GitHub secrets and Kubernetes imagePullSecrets. Harbor's Federated Identity Provider lets CI and your Kubernetes cluster authenticate with short-lived OIDC JWTs that map to robot accounts. Keyless and secretless from CI to cluster, with no GitHub secret, robot secret, or imagePullSecret to rotate. - [Hardening Harbor on AWS: Achieving Zero-Static-Secret Architecture](https://container-registry.com/posts/hardening-harbor-on-aws/index.md) — Standard Harbor deployments on AWS rely on long-lived credentials that violate modern security standards. In this post, I detail how I refactored Harbor to use ephemeral tokens via RDS IAM and IRSA, eliminating static keys entirely. - [Harbor at KubeCon London](https://container-registry.com/posts/harbor-at-kubecon-london-2025/index.md) — Meet the team behind Harbor at KubeCon London 2025 - [How to automate Flask development workflow with Container Registry and GitHub Actions](https://container-registry.com/posts/how-to-automate-flask-development-workflow-with-container-registry-and-github-actions/index.md) — This tutorial demonstrates how to create an automated workflow for building a containerized Flask application. We will use GitHub Actions to run the workflow and 8gears Container Registry as our image repository. - [KubeCon North America 2023 – The Takeaways](https://container-registry.com/posts/2023-kubecon-chicago-takeaways/index.md) — I took away some exciting insights from discussions and presentations at KubeCon 2023, the current hypes and long-term developments in the cloud-native landscape. During that week, I participated in two presentations and spent some time at the Harbor project booth speaking with Harbor users. Here are my takeaways from that intense week. - [How Does Dockers Decision of Sunsetting Free Team Organizations Impacts You](https://container-registry.com/posts/how-does-dockers-decision-of-sunsetting-free-team-organizations-impacts-you/index.md) — Even if you don’t have a team organization and what you can do about it. Docker Inc. continues on its course of eliminating free offerings: Now the "Docker Free Team" model has to take its turn. With the «Free Team Organizations» offering, it was possible to publish public container images for free in Docker Hub. Many open-source projects have taken advantage of the offer; however, the impact is affecting everyone. - [What's new in Harbor 2.6](https://container-registry.com/posts/whats-new-in-harbor-version-2.6.0/index.md) - [Container Image Versioning](https://container-registry.com/posts/container-image-versioning/index.md) - [Getting Started with Container Registry](https://container-registry.com/posts/getting-started-with-harbor-container-registry/index.md) — How to push and pull container image using our Harbor Container Registry a detailed step-by-step guide on working with container registries. - [Harbor Release 2.2.0](https://container-registry.com/posts/harbor-2.2.0-new-features-explained/index.md) - [Distributing Commercial Software Through Container Images](https://container-registry.com/posts/distributing-commercial-software-through-container-images/index.md) - [Lifting Developers’ Productivity with BuildKit CLI for kubectl](https://container-registry.com/posts/productivity-lift-buildkit-cli-for-kubectl/index.md) - [3 Ways to overcome the Docker Hub pull rate limit](https://container-registry.com/posts/overcome-docker-hub-rate-limit/index.md) — The newly introduced Docker Hub pull rate limit affects everyone working with containers and can cause service disruption. In this post, we look at situations when the download rate limit can catch you off-guard if you are not prepared. We also outline 3 ways to overcome the Docker Hub pull rate limit while also improving security and governance. ## Product & company - [Subscription Sandbox](https://container-registry.com/subscription/index.md) — Container Registry Subscription Sandbox - [Join Our Team](https://container-registry.com/career/index.md) — Join our engineering-led team building Harbor-powered container registry services. - [Our Partners](https://container-registry.com/partners/index.md) — Explore our global network of cloud-native engineering firms and service providers that build and operate container infrastructure. - [Container Registry for Team Collaboration](https://container-registry.com/team_collaboration/index.md) - [Secure Secret Sharing](https://container-registry.com/secrets/index.md) — Share passwords and sensitive data securely with end-to-end encryption, self-destructing links, and one-time downloads. Powered by Yopass. - [Contact Us](https://container-registry.com/contact/index.md) - [Success](https://container-registry.com/success/index.md) - [8gears Container Registry](https://container-registry.com/8gcr/index.md) — Enterprise Harbor Distribution, Built for Production. A hardened, enterprise-grade distribution of Harbor for teams that need more than upstream offers. - [Compare Container Registries](https://container-registry.com/compare/index.md) — Compare container registry approaches — cloud registries, artifact platforms, self-hosted Harbor, and 8gears Container Registry. Find the right fit for your platform team. - [Container Registry](https://container-registry.com/signup/index.md) - [Container Registry on AWS Marketplace](https://container-registry.com/aws/index.md) — Finalize your AWS Marketplace order for 8gears Container Registry — a fully managed, Harbor-based container registry on AWS with automated backups, upgrades, and 24/7 monitoring. - [Container Registry on Exoscale](https://container-registry.com/exoscale/index.md) - [Container Vending Machine](https://container-registry.com/container-vending-demo/index.md) — Explore the Container Vending Machine — a live demo of distributing and selling containerized software directly from 8gears Container Registry. - [Frequently Asked Questions](https://container-registry.com/faq/index.md) - [Pricing](https://container-registry.com/pricing/index.md) — Simple, transparent pricing for Container Registry. Free tier for individuals, dedicated instances for teams, and custom enterprise solutions. - [Where Every Team Converges](https://container-registry.com/harbor-for/index.md) — The holy trinity of DevSecOps on one registry that developers trust, security approves, and operations love. ## Reference - [Homepage](https://container-registry.com/index.md) — Site overview and entry point. - HTML site root: - Sitemap: