Harbor 2

Check the services, the Docker versions and the containers:

sudo systemctl is-active docker.service harbor.service harbor-firstboot.service docker --version docker compose version
sudo docker ps --format "table {{.Names}}\t{{.Status}}"

You should see active three times, Docker CE 29.x, Compose v2.x, and all eight Harbor containers in the Up state.

Read the credentials file:

sudo cat /stage/scripts/harbor-credentials.log

Note HARBOR_URL, HARBOR_UI_USER (always admin) and HARBOR_ADMIN_PASSWORD. The same file also contains HARBOR_DB_PASSWORD (the PostgreSQL password inside the harbor-db container) and a ready-to-paste HARBOR_DOCKER_LOGIN line.

Query the health and system information endpoints:

curl -sf http://127.0.0.1/api/v2.0/health | jq
curl -sf http://127.0.0.1/api/v2.0/systeminfo | jq '{harbor_version, registry_url, auth_mode}'

The first call hits the anonymous health endpoint of Harbor. It should return "status":"healthy" along with the status of each component: core, portal, database, redis, registry, registryctl and jobservice.

The second call prints the Harbor version (v2.15.0) and the registry URL.

Browse to http://<vm-ip>/ and sign in with admin and the password from Step 5.

After you sign in, the Projects page is the default view. The pre-created library project is public by default. Push images there without creating a new project, or click NEW PROJECT to add a private one.

Click Administration in the left sidebar. From there you can reach Users, Robot Accounts, Registries (replication targets), Replications, Labels, Project Quotas, Interrogation Services and Configuration.

From any machine that has Docker installed, log in to your Harbor instance, tag a sample image and push it to the library project. Replace <vm-ip> and <password> with the values from Step 5.

docker login <vm-ip> -u admin -p '<password>'
docker pull busybox:latest
docker tag busybox:latest <vm-ip>/library/busybox:latest
docker push <vm-ip>/library/busybox:latest

Refresh the library project in the Harbor UI. The busybox repository now appears with a manifest and one tag.

Pull the image back from a second machine, or from the same machine after you run docker rmi <vm-ip>/library/busybox:latest:

docker login <vm-ip> -u admin -p '<password>'
docker pull <vm-ip>/library/busybox:latest
docker run --rm <vm-ip>/library/busybox:latest echo "pulled from sac harbor"

For unauthenticated pulls from public projects, skip the docker login step.

Trivy is the CNCF reference vulnerability scanner for OCI images. It is omitted from the default install to fit the Standard_B2s RAM budget. Enabling it adds approximately 500 MB of resident memory for the Trivy adapter container, plus its CVE database cache.

Resize the VM to Standard_D2s_v5 (8 GB) or larger, then run the installer with Trivy enabled:

cd /opt/harbor
sudo ./install.sh --with-trivy

The installer brings the stack down, recreates docker-compose.yml with the Trivy service, and brings the stack back up.

When it returns, open Administration > Interrogation Services in the Harbor UI to confirm that Trivy is registered. Then open Projects > library > Configuration > Vulnerability scanning to enable automatic scans on push.

There are two production-ready options for adding HTTPS to Harbor.

Option A: Reconfigure the bundled nginx of Harbor for TLS. Edit /opt/harbor/harbor.yml and uncomment the https: block. Set the certificate: and private_key: paths to your PEM files and set hostname: to your FQDN. Then re-run the installer:

sudo nano /opt/harbor/harbor.yml cd /opt/harbor
sudo ./install.sh

Option B: Front Harbor with the system nginx and certbot (recommended). Point your DNS A record at this VM, then install nginx and certbot:

sudo apt-get update
sudo apt-get install -y nginx python3-certbot-nginx

Add a server block at /etc/nginx/sites-available/harbor-sac that proxies to http://127.0.0.1:80, the bundled nginx of Harbor. Enable the site, then run certbot:

sudo ln -s /etc/nginx/sites-available/harbor-sac /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx
sudo certbot --nginx -d harbor.example.com -m you@example.com --agree-tos --non-interactive --redirect

Finally, set hostname: harbor.example.com in /opt/harbor/harbor.yml and re-run sudo ./install.sh, so the metadata of Harbor advertises the public FQDN.

Harbor can mirror images to and from Docker Hub, Amazon ECR, Azure ACR, GitHub GHCR, Quay, GitLab and other Harbor instances. In the UI:

• Open Administration > Registries > NEW ENDPOINT. Pick a provider, enter the URL and access credentials, then click TEST CONNECTION and OK.
• Open Administration > Replications > NEW REPLICATION RULE. Choose Push-based or Pull-based, set the source and destination filters and a trigger (manual, scheduled, or event-based on push), then click SAVE.
• Trigger the rule manually from the Replications list to validate it, then leave the schedule running.

You can take a consistent backup while the registry is running. Dump the Harbor PostgreSQL database inside the harbor-db container with pg_dump, and add a tarball of the /data/registry directory (the image blobs):

sudo mkdir -p /var/backups/harbor
sudo docker exec harbor-db pg_dumpall -U postgres | gzip | sudo tee /var/backups/harbor/harbor-db-$(date +%F).sql.gz > /dev/null
sudo tar czf /var/backups/harbor/harbor-registry-$(date +%F).tgz -C /data registry

Periodically copy /var/backups/harbor to Azure Blob Storage (az storage blob upload-batch) for off-VM retention.

To restore on a fresh VM, stop Harbor (sudo systemctl stop harbor) and run gunzip | docker exec -i harbor-db psql -U postgres. Then untar /data/registry and start Harbor with sudo systemctl start harbor.

Read the service journals and the container logs:

sudo journalctl -u harbor.service --no-pager -n 80
sudo journalctl -u harbor-firstboot.service --no-pager -n 80
sudo docker compose -f /opt/harbor/docker-compose.yml logs --tail 50
sudo docker logs harbor-core --tail 50
sudo docker logs harbor-jobservice --tail 50
sudo docker logs harbor-db --tail 50

harbor.service is a oneshot wrapper around docker compose -f /opt/harbor/docker-compose.yml up -d / down. Its journal entries describe stack-level lifecycle events. Application-level logs live inside each container and are available through docker logs.

The bundled nginx container writes the web access logs of the portal. Run sudo docker logs nginx --tail 100 to see the HTTP request lines.