Core Components of Harbor: Enterprise Registry Architecture Explained

Harbor consists of eight tightly integrated microservices—Core, Portal, Registry, Job Service, Trivy, PostgreSQL, Redis, and Nginx—that work together to provide an enterprise-grade container registry with vulnerability scanning, RBAC, and cross-registry replication.

The goharbor/harbor open-source project implements a cloud-native container registry using a microservices architecture. Understanding the core components of Harbor is essential for platform engineers deploying scalable image storage solutions, as each service handles specific functions from metadata management to security scanning.

Harbor Core Components Overview

Harbor’s architecture separates concerns into discrete services orchestrated via official Helm charts or Docker Compose deployments. According to the source code analysis, component definitions reside in src/pkg/chart/testdata/harbor-schema2/README.md, which documents the internal TLS configurations and service dependencies for each microservice.

Core (API Server)

The Core service functions as Harbor’s central API server and metadata backend. As defined at line 112 of the Harbor schema documentation, Core stores project configurations, repository metadata, user accounts, and RBAC policies. It also issues service-to-service authentication tokens for internal communication between microservices.

Portal (Web Interface)

Portal provides the React-based web interface that users interact with for browsing repositories and managing projects. The component definition appears at line 125 of the schema file. All Portal operations call the Core APIs to render data, making it a stateless frontend that relies entirely on the backend services.

Registry (Image Storage)

Harbor embeds the standard Registry (Docker Distribution) component to store and serve image layers and manifests. Located at line 122 in the component list, this service handles all docker push and docker pull traffic, storing blobs and manifest files while Core maintains the metadata index.

Job Service

The Job Service executes asynchronous background tasks across the Harbor ecosystem. Defined at line 119 in the source schema, this component manages image replication between registries, garbage collection of orphaned blobs, vulnerability scan triggering, and user notification delivery.

Trivy (Vulnerability Scanner)

Trivy serves as Harbor’s built-in security scanner, pulling images from the Registry to detect Common Vulnerabilities and Exposures (CVEs). The scanner configuration appears at line 128 of the documentation. When scanning completes, Trivy stores results in the Database for display within the Portal interface.

PostgreSQL Database

The Database persists all Harbor metadata using PostgreSQL. Configuration references at line 337 of src/pkg/chart/testdata/harbor-schema2/README.md identify this as the mandatory relational datastore for user information, project settings, RBAC policies, and Job Service states.

Redis

Redis provides high-speed caching for session management, token lookups, and quota counters. The Helm values schema documents this component at line 361, enabling Harbor to cache transient data and reduce load on the PostgreSQL backend during high-traffic operations.

Nginx (Proxy)

The Nginx Proxy acts as the ingress gateway for all external HTTP/HTTPS traffic. Located at line 189 in the proxy component list, this service manages TLS termination, request routing, and load balancing across the Core, Registry, Portal, and Trivy endpoints.

Component Interaction Architecture

The microservices communicate through a defined request lifecycle:

1. User → Portal → Core: Users access the React-based Portal, which sends REST API calls to Core for all data operations.

2. Core ↔ Database/Redis: Core reads and writes persistent metadata to PostgreSQL while utilizing Redis for session caching and real-time quota tracking.

3. Core ↔ Registry: Core registers image metadata with the Database and coordinates with the Registry to store layers and serve pull/push traffic.

4. Core ↔ Job Service: Core creates asynchronous jobs (replication, garbage collection) that Job Service picks up, executes, and updates status in the Database.

5. Job Service → Trivy: When images are pushed, Job Service invokes Trivy to scan for vulnerabilities; results persist in the Database and display in the Portal.

6. Proxy (Nginx): All external traffic passes through Nginx, which handles TLS termination and routes requests to the appropriate backend component based on URL patterns.

Extensibility and Optional Services

Beyond the eight core components, Harbor supports optional services that extend functionality without modifying the base architecture. Notary provides Docker Content Trust for image signing, while ChartMuseum enables Helm chart storage. These services integrate with the existing Core and Registry components through the components section of the Helm values, as referenced in the source schema.

Summary

• Core Components: Harbor requires eight mandatory services: Core, Portal, Registry, Job Service, Trivy, PostgreSQL, Redis, and Nginx Proxy.
• Source Definitions: Component specifications are defined in src/pkg/chart/testdata/harbor-schema2/README.md with specific line references (112, 119, 122, 125, 128, 189, 337, 361).
• Data Flow: Nginx routes external traffic to Portal/Core, which coordinate with PostgreSQL, Redis, and Registry to process requests.
• Scalability: The microservices architecture allows independent scaling of the Registry, Job Service, and Trivy scanner based on workload demands.

Frequently Asked Questions

Is Harbor a monolithic application or microservices?

Harbor follows a microservices architecture. According to the goharbor/harbor source code, eight distinct services handle specific concerns: Core manages metadata and APIs, Registry stores image layers, Trivy handles vulnerability scanning, and Job Service processes background tasks. This separation enables independent scaling and maintenance of each component.

Which database does Harbor use for metadata storage?

Harbor uses PostgreSQL as its primary relational database. As defined in the Helm values schema at src/pkg/chart/testdata/harbor-schema2/README.md (line 337), PostgreSQL persists user accounts, RBAC policies, project configurations, and Job Service execution states. Redis complements this by caching session data and quota counters for performance optimization.

How does Harbor scan images for vulnerabilities?

The Job Service triggers scans by invoking Trivy when images are pushed to the Registry. Trivy pulls the image from the Registry component, analyzes it for known CVEs using its vulnerability database, and stores results in PostgreSQL. Users view these security reports through the Portal interface, creating an integrated DevSecOps workflow within the core Harbor components.

Can Harbor run without certain core components?

No, all eight core components are mandatory for a functional Harbor deployment. While optional extensions like Notary or ChartMuseum can be disabled through Helm values, the Core, Portal, Registry, Job Service, Trivy, PostgreSQL, Redis, and Nginx proxy must all be present. The Helm charts enforce these dependencies through the internal TLS configuration list documented in the source repository.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}