►
From YouTube: Webinar: Intro to Harbor
Description
Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io
Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects
Harbor is an open source cloud native registry that securely stores container images, signs them as trusted, and scans them for vulnerabilities.
Harbor solves common challenges by delivering trust, compliance, performance, and interoperability. It fills a gap for organizations and applications that cannot use a public or cloud-based registry, or want a consistent experience across clouds.
During this webinar, project lead James Zabala will demonstrate how Harbor can be used to provide a consistent cross-cloud registry experience. We’ll also discuss Harbor’s architecture, deployment options, and the project’s roadmap.
A
All
right
we're
going
to
go
ahead
and
get
started.
Welcome
to
today's
CN
CF
webinar
introduction,
CF
ambassador
ambassador
and
principal
product
marketing
manager
at
ansible,
I'd
like
to
thank
everyone
who
is
joining
us
today,
a
few
hi
housekeeping
items
before
you
begin
during
the
webinar
you're
not
able
to
talk
as
an
attendee.
There
is
a
Q&A
box
at
the
bottom
of
your
screen,
so
please
feel
free
to
drop
your
questions
in
there
and
we'll
get
to
as
many
of
the
end
as
we
can.
B
B
The
presentation
is
about
28,
25
slides,
maybe
30
I'll
get
to
it
pretty
quickly
and
then
we'll
get
to
a
demo,
but
leave
where
we
get
too
far
and
start
talking
on
all
the
different
features
and
functionality
and
how
the
project
started.
It
just
kind
of
wanted
to
share
the
mission
statement
that
we
have
for
harbor,
because
that
really
kind
of
sets
the
stage
for
the
different
things
that
we
add
to
the
project
as
it
progresses
so
about
a
year
ago,
or
so
we
all
sat
down
as
well.
B
B
But
that's
what
we've
decided
to
really
focus
on
here,
as
as
harbor
becomes
more
mature
project
so
for
the
ended
today.
This
looks
really
long,
I'm
a
little
bit
allergic
to
slides,
I'm
sure
many
of
you
you
are-
or
you
know,
technical,
but
I-
do
kind
of
want
to
cover
the
bases
here
before
we
get
too
far.
So
I'll
do
a
containers,
101
I'm,
completely
confident.
B
And
feel
free
to
ask
me
questions
Jonas,
as
Chris
mentioned,
is
on
the
phone
he's.
My
colleague
here
we
work
on
open
source
in
the
cloud
native
team
and
he's
happy
to
chime
in
while
I'm
presenting.
So
let's
get
started,
containers
101.
This
is
super
high
level.
My
thirty
thousand
forty
two
thousand
foot
view
of
what
a
container
image
is
of
a
system
for
those
that
are
either
rusty
or
are
not
completely
familiar.
B
Welcome
and
I
would
define
a
container
a
sort
of
a
hermetically
sealed
entity
that
contains,
inside
of
it
all
the
tooling
libraries
and
the
application
artifacts
that
are
needed
to
run
an
application.
That's
a
really
simple
definition
that
that
most
people
seem
to
grasp
even
even
c-level
folks,
who
are
too
technical.
This
diagram
is
pretty
busy
right.
Harbor
lives
in
the
upper
right
hand,
corner
I'll
just
try
to
keep
it
as
simple
as
possible.
Harbor
is
the
the
registry
in
the
upper
right
hand,
corner
right
and
a
container
in
an
image.
B
The
subtle
difference
is
that
one
is
running
at
a
container
and
the
image
is
what
what
is
actually
running
and
the
the
guiding
principle
here
for
harbor
is
that
it's
in
the
middle
of
this
pipeline
of
software
development
right.
So
you
have,
for
example,
on
the
bottom
left
hand
corner.
You
may
have
a
developer
and
his
or
her
laptop.
You
know
you
start
working
with
containers,
you
start
building
an
application
and
when
it
looks
good,
you
push
it
into
the
middle
which,
in
this
in
this
graphic,
is
harbor
and
then
on
the
other
side.
B
Maybe
another
developer
is
sitting
on
the
bottom
right
hand
corner
here,
and
they
need
to
take
that
image
and
start
doing
something
with
it,
whether
it's
running
tests,
putting
the
container
to
production,
etc,
and
so
what
they
do
is
they
pull
the
image
out
of
the
registry,
which
is
hardware
so
again
at
a
very
high
level?
What
harbor
is
doing?
B
So
what
about
harbor,
let's
dive
in
a
little
bit,
go
down
to
maybe
25,000
feet
so
harbor
was
started
in
2014.
It's
hard
to
believe.
It's
been
that
long
with
time
is
definitely
flung
as
an
internal
R&D
project
out
of
China
actually
from
our
China
team,
and
they
started.
As
you
know,
somebody
internally
complaining
that
they
didn't
have
a
place
to
put
docker
containers,
and
you
know
the
creator
of
the
project
Henry
sitting
down
and
hammering
out
some
code
to
change
that
scenario.
B
I
said
even
when
she
became
a
project
and
you'll
see
it
for
your
graphic.
You
know
a
while.
It
became
an
internal
serving
internal
incubation
project
and
then
it
was
open
source
and
the
rest
is
history.
Again
we
do
container
images
and
we
do
helm
charts
right,
so
the
helm
tried
all
kind
of
differentiator.
We
do
both
storing
hound
charts
on
harbor
and
we
also
are
working
on
running
harbor
as
a
helmet
chart
on
kubernetes.
So
when
I
say
on
the
chart
it
could
be
one
or
the
other
in
this
particular
bullet.
B
What
I'm
talking
about
a
storing
helm
truck
on
harbor?
One
of
the
pros
strong
points
of
having
Harbor
is
a
sort
of
container
registries.
It
doesn't
matter
where
you
run
it.
You
use
the
user
interaction
user
interface
is
identical.
This
is
a
little
bit
different
from
using
you
know,
GCP
and
their
container
registry,
as
your
amazon
has
one
you
may
be
using
docker
hub,
harbor
kind
of
brings
to
bear
the
fact
that,
regardless
of
where
you
brought
harbor,
you
know
on
Prem
rock
from
the
user
experiences
the
check
our
users
really
like
that.
B
It's
Apache
version,
two
obviously
and
I'm
sure
you
know
we
were
accepted
as
a
sandbox
project
in
July
and
it's
been
really
really
positive.
Experience.
We've
had
a
lot
of
contribution
increases,
whether
by
a
gain
of
issues
or
silks.
Actually
reading
code
during
PR
is
a
those
of
you
that
it's
been
there's
definitely
been
an
uptick
in
activity
since
so
graphically
I
mean
I'm
not
going
to
go
into
too
much
detail
here.
This
is,
you
know,
just
sort
of
a
timeline
that
I
keep
up-to-date
here
and
I
generally
share.
B
You
can
probably
read
it
offline,
but
it
again
started
as
a
very
small
project
in
2014
and
now
you
know
four
years
and
a
couple
of
months
later,
we're
part
of
the
CN
CF,
and
you
know
it's
a
pretty
popular
project
and
we're.
You
know
a
lot
of
folks
that
are
hopping
in
and
then
working
to
make
deposit.
B
More
more
open
source-
that's
here,
I,
won't
I,
won't
dive
into
the
details.
But
again
it's
been
a
lot
of
increases
and
contributions.
So
let's
talk
about
Harbor
here
in
terms
of
you
know,
concrete
features
and
what
it
does
and
so
on.
Harbor
was
built
as
a
multi-tenant
in
project
from
the
beginning
right.
So
if
you
go
and
download
dr.
distribution
version
to
this,
just
doesn't
this
isn't
something
that
comes
out
of
the
box.
B
B
This
ties
in
very
nicely
with
LDAP
groups
and
and
role
based
access
control,
which
is
one
of
the
key
principles
of
harbor,
meaning
that
you
have
to
explicitly
give
somebody
access
or
include
an
LDAP
group
or
an
Active
Directory
group
access
so
that
they
can
see
or
or
even
push
images
to
your
project.
Some
of
the
other
features
are
security
and
vulnerability.
B
Analysis
we'll
talk
about
that
in
lots
of
details,
but
it'll
ever
just
clear
to
scan
your
images
image
replication
again,
I'll
talk
about
that
as
well,
but
the
idea
here
is
that
you
know
harbor
registry.
A
can
automatically
replicate
images
to
hardware
registry,
be
with
with
no
intervention
on
your
part
once
you've
setup
the
replication
rules
from
a
day
to
opt
experience.
I
think
that
you
know
everything
runs
in
containers,
that's
sort
of
irrelevant
if
you're
using
it,
if
you're
certainly
doing
development
on
it.
B
C
C
B
Post-Crisis
the
database
we
leveraged
Redis
for
the
bigger
components
that
we
use
in
terms
of
view,
the
different
registry
like
components
or
container
like
components.
We,
you
have
docker
distribution
version
two
here
on
the
bottom
right.
The
vulnerability
scanning
is
clear,
which
is
a
core
OS
project
and
the
trusted
content
is
another
CMC,
a
project
notary.
B
The
blue
pieces
is
sort
of
a
again
the
magic
part
that
Harbert
uses
the
glue
can
get
it
so.
The
core
services,
for
example,
API
it's
what
you
interface
with.
When
you
use
the
the
the
user
interface,
the
UI,
it
provides
a
layer
that
will
block,
pushes
and
pulls
if
vulnerability
scans
are
failing,
and
it's
how
you
you
pretty
much
how
you
control
Harper
at
high
level,
you
configure
your
your
application
and
so
on,
and
the
particular
layer
of
stack
on
the
right
hand,
side
you'll,
see
that
we
have.
B
Docker
compose
is
perhaps
the
most
prevalent
way
to
deploy
a
harbor
today
helm.
Chart
is
definitely
that
you
know
kind
of
the
way
of
the
future
and
what
we're
focusing
on
doing
it.
Some
we
developed
it
and
deployed
it.
Sorry,
shipped
in
version,
one
six,
which
happened
a
couple
of
couple
of
weeks
ago,
maybe
a
month
or
two
ago,
and
it's
definitely
getting
better
and
ever
really
so
kind
of
a
youngish
part
of
the
project,
but
now
we're
polishing
it
up
as
we
go.
B
C
B
File
storage,
where
it's
block
storage!
You
know!
If
you're,
you
know
an
SRE,
it's
pretty
easy
to
kind
of
get
all
these
things
together
and
and
make
it
work
on
whatever
storage
back-end.
You
want
stuff
as
well
I'll
skip
over
this,
but
but
we
do
have
a
lot
of
users.
So
it's
not
a
baby
project
and
on
quite
a
while.
Some
of
these
users
literally
have
millions
of
container
images,
so
lots
of
lots
of
users
that
are
that
are
leveraging
Harper
image
consistency.
B
B
First
of
all,
we'll
look
at
a
docker
file
here
at
the
top,
where
you
have
you
know:
firma
blue
tube,
you're,
going
to
use
apt
to
install
Python,
and
then
you
go,
and
you
add
your
your
java
application
to
the
container
right.
So
you
can
do
this
and
if
you
know
what
you're
doing,
if
you're
doing
it
a
long
time,
great
you'll
probably
avoid
all
the
small
pitfalls.
All
the
things
that
could
happen
if
you
sort
of
need
to
the
container
ecosystem,
but
there
are
challenges
here,
if
you're,
not
careful
right.
B
If
you
go
and
build
the
docker
file
in
green
today,
and
then
tomorrow
you
go
and
do
it
in
your
QA
environment
and
the
QA.
You
know
that
the
pipeline
is
going
and
building
this
docker
file
as
part
of
the
process,
there's
a
possibility
that
the
glue
to
latest
tag
has
changed
or
that
a
boon
to
1404
became
it
was
into
1404
dot.
One
right
there's
also
a
very
good
likelihood
that
that
your
apt
command
is
actually
pulling
something
different.
B
It's
not
deterministic
the
packages
may
not
be
identical
and
of
course,
every
time
you
do
an
add
to
the
container,
unless
you're
absolutely
present
show
that
the
artifact
is
not
changed
it
could
it
could
have
changed
right.
So
again,
these
are
all
things
you
can
address.
If
you're
careful-
and
you
know
you
know-
you
know
how
to
set
this
up
in
here-
you're
very
prudent
from
you
know
getting
your
pipeline
from
point
A
to
point
B.
B
But
you
know
hardware
brings
this
idea
of
a
a
replication
feature
to
the
table,
and
this
is
not
a
you
know:
silver
bowl.
You
should
still
do
containers
right
and
there
again
a
lot
of
little
things
you
have
to
be
careful
about,
but
it
does
allow
you
to
kind
of
do
this
pipeline
from
point
A
to
point
B,
where
you're
going
from
a
dev
environment
to
QA,
staging
and
prod
with
all
of
these
different
registries,
but
most
of
our
larger
users
have
container
registry
for
Deb
one
for
QA.
Look
for
staging
like
a
prod.
B
It
allows
you
to
replicate
images
from
point
A
to
point
B
and
ensure
that
the
images
themselves
are
unchanged
throughout
this
type
of
this
process.
Alright
and
I'll
point
out.
You
know
this
slide
is
very
high
level,
but
I'll
point
out
that
the
initial
application
you
can
set
policies
like
filtering
on
labels
on
tags,
on
specific
projects
and
then
very
similar
to
a
ZFS,
send,
for
example,
we're
only
change.
B
The
blocks
are
sent
on
a
second
send
on
a
second
replication
harbour
will
intelligently
choose
only
the
things
have
changed
from
point
A
to
point
B,
or
rather
from
time
8
to
time,
B
from
the
initial
replication
to
the
second
complication
and
to
put
kind
of
a
picture
behind
what
I
was
just
discussing.
You
know
here.
B
And
this
is,
this
is
actually
a
graphic
that
we
worked
on
with
a
user
if
he's
been
using
harbor
for
a
load
a
long
time.
So
this
is
a
real-world
scenario
and
we
have
a
Deborah
registry
where
a
bunch
of
developers
are
pushing
images,
pulling
images,
making
changes
and
then
once
things
are,
you
know
get
to
the
point
where
the
developers
feel
confident.
They'll
push,
deoxy
push
the
images
to
a
test
registry
and
then
manually
push
it
to
staging
and
production,
and
you
can
imagine
this
caused
some
heartache.
B
This
pipeline,
where,
when
an
image
is,
you
know,
hid
in
the
dev
registry
when
an
image
goes
into
a
special
project
called
completed,
for
example,
it'll
get
pushed
to
test,
and
once
the
CI
pipeline
feels
that
the
you
know,
the
tests
have
all
passed,
it'll
put
it
in
another
project
and
then
it'll
get
pushed
to
staging
and
production
and
so
on.
This
makes
NF
saris
life
very
easy
and
also
ensures
that
the
quote
unquote,
binary
format,
right
and
I
use
that
loosely.
C
C
C
B
Well,
doctor
trusted
registry,
to
the
best
of
my
knowledge,
is
a
commercial
project
and
it's
not
based
on
docker
distribution
version
two.
So
if
I
go
back
here
to
this
slide,
this
component
right
here
is
docker
distribution
version
three
right:
it's
sort
of
the
the
the
workhorse
in
the
the
dot
and
the
end
of
harbor
stack
DTR
to
the
best
of
my
knowledge
and
I
could
be
wrong.
It's
not
leveraging
dr.
B
C
B
B
So
there's
two
concepts
related
to
security
here
and
they're
different,
but
they're
both
important
number
one
is
security.
It's
sort
of
a
harbor
level
of
the
role
based
access
control.
We
touched
on
that
briefly
and
then
the
second
part
of
this
is
container
security
right
and
by
that
I
mean
vulnerability.
Scanning
and
I
also
mean
provenance
of
images,
so
we'll
go
through
this
relatively
quickly
here,
our
back
is
what
this
slide
is
talking
about
and
in.
B
Instance,
all
we
mean
is
different:
people
should
have
different
permissions
at
a
developer.
Who's
working
on
a
specific
application
may
or
may
not
need
read,
write
access,
while
QA
is
unlikely
to
be
doing.
You
know
coding
work
on
that
software
product
itself,
and
so
they
would
only
have
read-only
access
to
where
this
create
project.
As
an
example,
you
can
tie
this
to
individual
identities
in
LDAP
to
a
role
in
harbor
or
you
can
tie
groups
of
users
LDAP
groups
of
users
to
role
in
harbor,
LDAP
or
ad.
B
As
he
said,
this
is
a
graphical
way
of
looking
at
that.
You
know
the
box
on
the
right.
You
know
sort
of
connotes
a
different
container
images
go
and
gen-x
whatever.
Maybe
you
have
developers
who
are
pushing
and
pulling
to
that
quote-unquote
box
that
that
collection
of
images
lives
in
a
specific
project?
You
know,
I
guess,
may
only
have
docker
pull
access
to
those
images,
while
an
admin
at
the
bottom
and
I
haven't
talked
about
that
much
but
and
I'm
really
privileged.
Lease
privileges
is
sort
of
that.
B
So
now
kind
of
switching
gears
to
the
container
piece
of
the
puzzle.
Number
one
is
making
sure
that
images
are
not
changed
so
I'm
a
developer,
I
push
an
image,
I
sign
it
using
my
private
key
and
I
want
to
make
sure
that
when
another
developer
grabs
manage
it's
not
changed
right
and
that-
and
that
is
a
notary,
and
that
is
what
we
leverage
in
the
harbor
stack
to
make
that
happen.
B
So
this
is
the
graphical
representation
of
notary.
This
is
nothing
special
is
exactly
what
it
will
work
like,
or
even
look
like
if
you
were
to
deploy
dock
and
distribution
version,
2
and
notary
separately
and
sort
of
integrate
them
together.
What
you
have
is
the
creator
on
the
left-hand
side
and
your
Qi
is
going
to
push
a
tag.
I
push
a
container
image
and
assign
the
manifest
and
Senate
the
notary
bylaw.
B
On
the
other
side
of
the
puzzle,
the
consumer,
the
yellow
on
the
right,
is
responsible
for
pulling
the
image
using
the
the
digest
that
was
created,
and
so
the
notary
piece
is
at
the
top
and
it's
responsible
for
the
defining
piece
in
terms
of
one
ability
scanning
we
use
Claire,
as
I
mentioned.
Some
of
the
interesting
things
about
clear
in
the
the
harbor
context
is
that
you
can
set
a
threshold
all
right
so
NS
already
may
say:
hey
great,
you
know,
create
your
images.
B
B
B
This
is
not
Hardware,
specific
and
I.
Think
if
you
want
any
sort
of
a
container
registry
in
production,
that's
being
actually
used
heavily
between
developers
and
QA,
and
you
know
pipelines
and
communities
clusters
pulling
images.
You
know
if
it
has
enough
traffic,
there's
going
to
be
a
contention
on
the
network
and
I'm
the
disc
I'm
sure
you
can
you
can
design
something
to
scale
out.
You
know,
docker
distribution
is
I
mean
we
don't
the
claim
to
fame.
Here
is
not
that
we've
solved
a
you
know
an
unsolved
problem,
but
rather
that
we've
made
it
easier.
B
What
we
do
here
is-
and
this
is
there's
lots
and
lots
of
permutations
and
combinations
available
here
right,
but
we're
replication
and
this
particular
context
allow
individuals
to
get
creative
about
how
they
spread
the
load
right
and
by
load.
I
mean
the
actual
use
that
the
heavy
use
against
the
container
registry.
B
So
this
is
perhaps
the
most
simple
example
whereby
developers
are
hitting
a
main
harbor
node
or
at
the
green
wanna,
stop
pushing
images
as
necessary,
and
then
all
the
other
you
know,
work,
that's
being
done,
is
generally
pull
right,
again:
QA,
CI
and
possibly
putting
things
into
production,
kubernetes
cluster
as
an
example.
Those
are
all
activities
that
are
pulling
images
and
that
can
be
spread
across
multiple
harbour
nodes
using
replication.
B
Case
number
one
in
use
case
number
two
weird
talked
about
in
a
previous
graphic,
which
is
putting
things
closer
to
the
destination
whereby
kubernetes
node,
for
example,
does
not
the
pole,
gigs
and
gigs
across
you
know
a
couple
of
continents
and
competing
with
it:
you're
not
trying
to
outpace
the
speed
of
light,
so
putting
things
closer
is
always
better,
so
replication
I,
you
know,
as
I
was
putting
this
slide
together.
I
thought.
Well.
C
B
No,
but
in
that,
no
it
cannot.
But
in
that
case,
for
example,
what
would
happen
is
part
of
your
CI
pipeline
or
QA?
Perhaps
your
QA
automation.
They
would
if
it's
a
test
path,
they
would
tag
an
image
that
has
passed
and
quote-unquote
push
it
to
the
same
harbor
node
and
what
happens
is
if
you,
if
you,
if
you
had
a
harbor
node
and
it
has
an
image
Alpine
and
then
you
go
and
you
tag
it
and
you
call
it
Alpine
and
the
tag
is
new
and
then
you
would
do
a
docker
push.
B
Harbor
is
intelligent
enough
to
know
hey,
wait
a
minute.
I
already
have
this
image,
it's
identical,
I'm,
just
gonna,
add
a
metadata
tag.
I'm
not
actually
push
any
data.
There's
actually
no
transfer
of
you
know
actual
image
bits
in
that
process.
So
I
guess
my
point:
is
you
don't
need
replication
in
that
use
case?
You
would
just
need
tooling
to
promote
things
from
one
project
to
another.
If
we're
only
talking
about
one
harbor,
node
cool.
C
B
C
B
A
C
Good
alright,
so
let's
talk
about
a
Claire
for
a
little
bit
here.
What
if
an
image
is
detected
to
be
visit
from
mark
goes
on
what,
if
an
image
is
detected
to
be
vulnerable
after
a
new
CBE
is
published,
does
Harvard
do
anything
like
notifications
or
something
like
that?
So
we
know
that
this
now
vulnerable
image
is
already
running
in
production.
C
B
That's
great
feedback
and
we're
fully
aware
that
we've
had
a
couple
of
other
folks
ask
for
that.
So
there
is
no
notification
aside
from
manually
going
into
the
UI
and
looking
so
there's
a
there's,
a
moderately
easy
way
for
us
to
do
this,
but
we
don't
have
it
quite
yet
on
the
list
of
things
you
want
to
do
for
sure.
Okay,.
B
B
C
B
Good
I'll
add
one
more
thing
about
that:
if
there
is
something
you're
interested
in
seeing
please
pinging
on
github,
just
so
that
we
can
track
it,
you
know
to
the
end
and
so
that
we're
sure
that
when
we
do
modular
eyes
harbor
that
we
do
it
in
a
way
that
you
know
perhaps
insert
your
favorite
tool
here
would
fit
nicely
with
the
architecture
harbor.
So
so,
if
you
could
share
some
more
information,
please
up
assign
it
to
me
and
I'm
happy
to
chat
with
you
about
it.
Great.
B
So
I'm,
what
I
will
say
is
that
most
of
the
use
cases
that
I
have
seen
involved,
CI
CD
signing
images
so
that
once
it
passed
that
we
are
confident
that
what's
running
in
production
is
actually
what
came
out
of
the
pipeline.
That's
what
I've
seen
most
common
I've
not
seen
the
security
things
can't
assign
images,
but
honestly
I
can
think
of
maybe
six
customers
that
are
using
the
signing
feature
in
production
on
a
daily
basis
and
so
I.
Don't
have
a
whole
lot
of
data
points
feature
here.
B
B
We
definitely
want
to
do
AJ
right,
so
I
think
that
the
short
answer
is
we're
working
on
the
charts,
the
helm,
chart
and
I
think
that
the
helmet
art
will
probably
provide
will
get
us.
80
is
80%
of
the
way
there.
You
know
the
thing
about
h8
just
in
general,
and
this
is
certainly
not
me
making
excuses,
but
just
acknowledging
the
complexity
of
something
like
this
is
that
everybody's
environment
is
different
right.
You
have
shared
stories,
you
are
using
local
storage,
so
you
have
a
load
balancers.
B
You
know
the
kind
of
a
seventh
of
five
in
the
dungeon
action
that
Sisko,
you
know
low
budget,
all
sorts
of
different
pieces
here
that
make
the
concept
of
doing
a
che
a
little
bit
more
complex,
and
it
would
be
if
this
wasn't
an
infrastructure
level
open
source
project,
but
again
I
think
that
the
helm
tart
will
get
us
really
really.
You
know
really
really
to
a
comfortable
place
where
most
users
are
likely
satisfied
with
with
the
capabilities
that
that
come
with
harbor
laying
on
top
of
alternatively
or
perhaps
would
have
said
in
tandem.
B
We
are
looking
at
features
like
clustering
like
this.
Is
a
much
bigger
change
from
a
code
perspective,
but
I
think
that
you
know
I'm
sure
Chris
agrees
with
me.
You
know
the
red
Hatter
STDs
beautiful
right,
so
you
kind
of
just
point
a
bunch
of
note
that
each
other-
and
you
have
this
cluster
and
you're
confident
that
is,
you
know
strongly
consistent
using
grass
and
you
know
so
on
so
put
it
be
nice
to
add.
That's
what
a
feature
to
harbor
we'll
talk
about
the
road
map
here
and
you
know
a
little
while.
B
Certainly
customers
have
seen
users
have
asked
for
this
before
you
know
it
would
make
it
easy
to
just
take
a
bunch
of
harbor
notes
and
haven't
talked
to
each
other
and
share
metadata
and
transfer.
You
know
labels
and
so
on
and
so
forth
and
configuration.
So
that
is
something
that
we've
certainly
been.
B
Yep,
okay,
cool,
so
the
first
thing
I'll
say
here
is
that
and
that's
why
I'll
kind
of
breeze
through
the
demo
here
and
just
kind
of
give
you
a
quick
walkthrough?
You
can
use
this
yourself,
demo
go
harbor
dial
and
then
you
can
just
click
the
sign
up
for
an
account
go
through
the
process,
and
you
know
you'll
have
access
to
to
this
environment,
and
so
you'll
see
here
that
there
are
actually
this
environment
reset
every
couple
of
days.
B
So
when
you
log
in
you
get
a
list
of
projects
again,
this
is
sort
of
a
multi-tenant
principle
here,
where
you
know
I'm
an
admin,
so
I
can
see
all
the
projects,
but
if
I
were
to
log
in,
as
you
know,
a
specific
user
I
would
only
see
the
positive
I've
access
it.
Okay,
a
couple
data
points
here
in
terms
of
you
know
the
number
of
projects
and
repos,
and
so
on.
Some
quick
glance
at
how
much
storage
is
available
and
we'll
go
through
through
these
one.
B
At
the
time
here
in
just
a
second
logs
is,
is
obviously
gives
you
access
to
data
about
who
pushed
you
polled
and
what
sort
of
changes
were
made
in
the
UI.
Here
we
have
our
users.
Now
you
can
see
again
bunch
of
a
bunch
of
folks
who
are
just
playing
with
the
environment.
You
can
make
a
user
and
admin.
If
you
need
to,
then
he
or
she
will
have
acess
that
reason
registry.
This
is
a
pretty
straightforward
here.
We
define
registries
other
than
what
we're
logged
into
so
for
demonstration
purposes.
B
I
put
you
know
a
demo
to
endpoint
your
demo.
C
doesn't
exist.
If
it
did,
I
would
then
be
able
to
go
into
the
replication
section
and
define
a
replication
rule
that
says:
hey,
listen,
everything
inside
of
my
webinar
project
will
be
get
replicated
to
demo
alright
and
then
I'll
be
able
to
trigger
to
trigger
this
manually.
If
I
need
to
you
can
also
trigger
scheduled
or
immediately
so
that
if
I
do
a
push
the
webinar
project,
it
will
automatically
get
replicated
to
demo
to
go
harboured.
I,
oh
okay,
so
again
snow
doesn't
exist.
B
Unfortunately,
but
you
can
see
here
that
there
are
a
bunch
of
errors,
obviously,
because
it
doesn't
exist
this
node,
but
that's
just
how
easy
it
is
to
create
replication.
So
if
you
had
an
environment,
you
know,
as
I
showed
in
the
and
the
slide
that
had
the
big
green
harbor
at
the
top
and
a
you
know
a
bunch
of
smaller
harbors.
You
know
for
geo
locality
at
the
bottom.
You
know
we
just
have
to
create
a
bunch
of
registries
and
set
up
the
rules
to
replicate
them.
B
So
it's
a
one-time
thing
configuration
is
also
pretty
straightforward.
You
can
either
off
by
LDAP
or
database.
We
allow
software
registration,
so
please
feel
free
again
demo
Deco
Harbor
to
I/o,
Emma,
I'm.
Sorry,
email!
Excuse
me,
guess:
I
have
a
ton
of
coffee
emails
to
send
you
alerts
for
different
thing
system
setting
labels.
Labels
is
kind
of
a
new
thing.
We
may
be
moving.
B
This
I'm
not
sure,
makes
a
whole
lot
of
fun
to
put
it
in
the
label
section
under
configuration,
but
you
can
add
all
sorts
of
things
here:
the
name
the
color
setup,
so
very
Gmail
like
and
then
vulnerabilities.
You
can
hit
scan
now
right,
so
I'll,
just
let
clear
run
in
the
background
and
start
scanning
images
and
it'll
scan
all
the
new
and
they
just
and
I
have
pushed
and
I
set
up
about.
The
last
can
okay,
so
I'll
show
you
here.
B
Real
quick
I
mentioned
during
the
presentation
again
signed
is
an
X,
which
means
I.
Don't
have
notary
right.
Vulnerability
is
if
the
piece
here
that
most
of
our
folks
work
rely
on
when
they're
putting
things
in
the
production.
So
in
this
case
you
see
there
is
one
high
vulnerability
identified
and
a
bunch
of
other.
You
know
lower
one
five
five
bit
in
that
six
level,
so
here
I'm
digging
in
a
project
one
on
Redis
and
you
can
actually
see
the
CBE
data
that
came
from
this
particular
vendor.
B
B
B
And
you
go
to
configuration,
prevent
vulnerable
images
for
money,
so
here
we're
going
to
put
hey
anything
over
medium
I.
Don't
want
to
I,
don't
trust
it
I
don't
want.
I
don't
want
to
run
this
thing
so
here
this
this,
the
core
component
of
harbor
will
block
the
soccer
pull
or
any
images
that
have
a
high
valid
ability
in
this
case,
reddish
would
fail
dr.
pol
and.
B
Let's
see
a
couple
things,
how
much
art
is
broken
in
this
bill,
but
I'm
sorry
that
this
is
my
fault.
I
pushed
it.
A
new
release
of
this
recently
in
the
charts
piece
is
not
working,
but
some
charts
world
will
appear
here.
Members
are
actual
individuals
who
belong
to
the
project
so
again,
unless
you're
any
project
or
you're
an
admin,
you
won't
see
the
project
you
can
set
up
replication
from
here
labels
blogs
and
again
you
can
do
some
configuration
specific
to
that
project.
B
B
Repos
that
I
created
here
for
the
red
one
webinar
excuse
me
and
because
this
project
is
public,
you
can
actually
see
them
on
the
work
here.
Ok,
mom!
So
that's
the
demo
I
encourage
you
to
play
with
it.
I
think
I
think
that's
the
best
way
to
learn
at
least
that's
the
best
way.
I
learned
and
certainly
it'll,
give
you
a
pretty
good
idea
of
what
harbor
is
and
then
how
it
works.
B
Two
or
three
more
slides
here
and
we're
done
that
that
was
the
mean
potatoes
of
the
presentation
roadmap
just
to
confirm
Jonah.
So
you
can
see
my
screen
yep
great
one.
Seven
is
enroute,
you
can
click
the
link
here
and
I'll
share
this
credo
to
see
the
different
features.
I
was
not
for
one
seven
one:
seven
should
land
sometime
at
the
end
of
the
year,
I
suppose
one
eight
is
still
up
for
grabs,
so
you
know
really
making
a
huge
emphasis
on
ensuring
that
the
community
has
really
strong
input
over
the
direction
of
the
project.
B
Please
chime
in
on
github
particularly
open
an
issue,
for
example
the
question
on
doing
it
as
a
proxy
or
a
cache
for
it,
a
docker
hub,
very
popular
and
the
only
way
that
we
know
that
people
really
really
want.
This
is,
if
you
tell
us,
so
please
do
ping
us
on
github.
Well,
these
are
the
things
that
are.
B
This
is
a
short
list,
there's
a
lot
of
things
that
should
appear
here,
but
I,
don't
like
slides
with
a
terrible
amount
of
text,
quotas,
life
cycle
management
of
harbor
via
home,
charts,
image,
proxying
and
caching
is
exactly
we're
asked
about.
So
you
know
the
idea:
hey
look.
I
only
want
my
developers
to
pull
from
harbor,
but
there
are
images
that
live
on
docker
hub,
that
I
need
to
be
able
to
provide
for
them,
so
I
want
Harvard
to
sort
of
be
that
intermediary.
That's
a
very
popular
feature,
request
token,
based
authentication.
B
The
clustering
is
a
big
one.
I
think
that
eventually
will
probably
come
to
fruition,
but
it
may
be
a
while
improved
our
back
and
multi-tenancy.
By
that
I
mean
you
know,
we've
had
requests
for
adding
an
extra
layer
of
multi-tenancy.
So,
instead
of
just
having
projects,
you
would
have
a
tenant
and
a
project
whereby
a
tenant,
for
example,
would
be
a
line
of
business
and
a
project
would
be
individual
well
projects
that
the
line
of
business
was
working
on.
B
You
know
if
you
look
at
kubernetes
as
an
example,
but
you
know
hundreds
and
hundreds
of
commits
today.
Harbor
has
a
much
more
manageable
amount.
So
if
you
want
to
contribute,
please
documentation
we're
seeing
a
lot
of
folks
that
are
coming
they're
wrangling
issues
whatever.
Maybe,
if
you
feel
comfortable,
please
reach
out
I'm
happy
to
walk
you
through
the
process.
Spock
is
probably
a
good
way
to
get
me.
You
know
real
time
and
I'm
always
on
it,
and
the
last
thing
I'll
say
is
paying
us.
B
You
know,
github
is
solasko
harbor
misty
organ
in
go
harbor
at
I/o
and
ping
us
on
the
CNCs.
Lockheed
is
a
harbor
channel
there
Harbor
deaf
Channel
and
I
sort
of
live
there.
So,
if
you,
you
know
get
if
you
want
to
contribute
something
or
you
have
a
question,
please
feel
free
to
print
yeah
I'm
happy
to
help.
However
I
can
so
should
we
dive
into
the
lot
for
the
questions.
Let's.
C
B
C
B
Zero
today,
but
that
we
actually
have
an
organization
inside
a
it's,
not
a
VMware
anyway.
Who
wants
to
do
this
and
I
suspect
we'll
probably
start
seeing
some
contributions
for
that
particular
alignment
sooner
than
later,
but
but
that
I
think
that
is
sort
of
the
goal
is
really
offer
that
as
a
potential
integration.
C
B
That's
a
great
question:
maybe
maybe
I
think
that
I
think
that
our
focus
right
now
is
container
registry
and
atom
chart.
Only
because
when
we
wrote
our
mission
statement,
there
was
a
little
eight
of
us.
I
would
love
to
see.
Harbor
see,
you
know,
be
a
sort
of
an
artifact
store
for
all
sorts
of
things,
including
NPM,
maybe
rpm
Deb
packages
and
perhaps
more
importantly,
it
build
right.
It
is
ticking
bills
and
storing
them
in
an
immutable
manner
for
for
business
purposes.
So
I
am
super
open
to
that
idea.
C
B
Okay,
so
then
that
would
be
the
artifact
store
question
that
we
just
discussed.
No
there's
no
way
to
store
artifact
Bob,
built
images
or
build
artifacts.
Today,
I
saw
some
container
with
this,
so
there
is
no
plugin
I
guess
the
easiest
way
to
do
it.
If
you're
doing
this,
you
have
pipeline
is
just
to
spit
out
the
final
image
into
a
specific
project
inside
of
harbor,
but
we
can't
store
anything
else.
B
C
B
It's
I
mean
I,
don't
want
to
say
it's
custom
that
sounds
like
proprietary
software,
it's
just
a
it's
just
a
replication
that
we
built
using
a
docker
push
and
pull.
However,
I
copy
out
that
by
saying
that
we
can't
replicate
to
say
docker
distribution
version,
two
it
can
only
replicate
to
and
from
harbor
today
we
didn't
do
that
for
lock-in
or
any
reason
we
just
happened.
B
We
just
haven't
added
the
functionality
to
pull
and
push
to
other
registries,
but
it
is
something
that
a
lot
of
folks
have
asked
for
and
we'll
definitely
get
to
it
sooner
or
later.
So
that's
sort
of
part
of
the
image
caching
class
processing.
That
I
was
mentioning
eventually
we'd
like
to
be
able
to
push
and
pull
to
other
registries
replicate
other
registries,
cool.
C
B
It's
fully
API
driven
the
UI
is
an
angular
app
using
clarity.
The
UI
framework,
everything
is
driven
by
an
API
part
of
a
harbor
kettle
tool
that
I
was
talking
about,
will
will
get
us
there
to
the
point
where
it's
CLI
driven,
but
we
have
a
lot
of
users
who
have
written
custom
tooling
to
expire,
older
tags
or
do
reporting
outside
of
you
know,
outside
of
the
UI,
to
show
you
know
the
lifecycle
of
images
or
whatever
it
may
be.
No,
it
can
definitely
be
configured
outside
of
the
UI.
B
C
C
B
C
B
How
is
it
different
I
mean
one
is
a
product
that
is
sold
yeah
I've
used
to
way
it
has
a
couple
of
things
we
don't
have
right
now,
such
as
web
hooks
I.
Think
that's
the
one
that
sticks
out
in
my
mind,
so
that's
currently
missing
from
harbor
yeah
I
mean
sure
it
depends
on
how
you're
using
Quay
right
Quay
integrates
really
nicely
with
with
some
of
the
their
product
offerings.
B
So
I
don't
know
that
I
want
to
go
out
and
say,
like
yeah,
you
can
replace
Kuwait
with
harbor,
but
for
the
most
I
think
the
feature
gap
is
relatively
small,
yeah
and
I'm,
confident
right,
how
will
open
source
Kwai?
So
you
know
be
nice
to
have
a
another
partner
in
crime
here
in
the
TNCs,
so
I
don't
know,
maybe
but
I'm
happy
to
hear
about
any
features
that
are
missing
from
harbour,
that
Quay
house
that
we
can
that
we
can
add
it.
If
you,
you
know,
if
you'd
like
to
show
that
feedback.
C
B
Well,
there's
a
couple
different
ways
to
do
the
UI,
perhaps
in
lowest
barrier.
If
you
have
you
know,
we
certainly
have
users
that
have
so
many
projects
and
there's
automation
around
those
projects
and
and
so
on
that
they
use
the
API
to
create
the
project
delegate
access
properly
and
set
up
the
replication
again
all
API
driven
so
I
guess
it
depends
on
how
complex
are
you
stated,
but
it
can
definitely
be
done
either.
You
know,
through
the
UI
or
by
an
API
and
seamless
EOI,
perfect.
B
Believe
Portus
is
a
way.
Okay,
so
I'll
preface
it
by
saying
that
I
have
only
used
Portus
once
or
twice,
and
it's
been
a
little
while
I
believe
Portis
has
meant
to
manage
containers
while
harbor
is
a
container
registry
I.
Don't
think
that
port
is
a
container
registry
but
I,
honest
I
couldn't
be
wrong.
It's
been
a
while
since
I've
touched
it
I'm.
B
C
C
B
A
wiki
page
that
talks
about
it,
there's
caveats
and
you
know,
as
with
all
software,
between
every
release
for
the
most
part,
it's
just
a
script
that
you
run
to
my
greatest
EEMA,
the
post
schema
and
then
you
bring
up
a
new
version,
so
it
is
sort
of
a
one-way
deal,
but
I
guess.
The
specific
answer
is.
It
depends
on
what
version
you're
upgrading
from
and
to,
but
we
certainly
made
an
easier
with
every
relief.