skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

securing-container-registry-with-harbor

Configures Harbor registry security including vulnerability scanning, content trust, RBAC, and immutable tags.

954|172|Updated Mar 13, 2026
Search Tags:#rbac#kubernetes#container registry#vulnerability scanning#trivy#harbor#Cosign
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill securing-container-registry-with-harbor
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: securing-container-registry-with-harbor
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/container-security/securing-container-registry-with-harbor
Command: npx skills add https://github.com/xalgord/xalgorix --skill securing-container-registry-with-harbor

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Container registries often run with permissive defaults that allow vulnerable, unsigned, or unauthenticated images to be pulled and deployed. This Skill guides you through hardening a Harbor registry so that image provenance is enforced, vulnerable images are blocked, and access is properly controlled.

Core Features & Use Cases

  • Vulnerability Scanning Enforcement: Configure Trivy auto-scan with prevent_vul policies so images exceeding a severity threshold cannot be pulled.
  • Content Trust & Signing: Enable Notary/Cosign content trust at the project level and verify image signatures before deployment.
  • Access Control & Retention: Set up private projects, RBAC roles, OIDC authentication, immutable tag rules, and retention policies.
  • Use Case: A platform team deploying Harbor on Kubernetes uses this Skill to configure auto-scanning, block critical-CVE images, enforce Cosign signatures on release tags, and integrate Okta OIDC for team access.

Quick Start

Use the securing-container-registry-with-harbor skill to configure my Harbor deployment with auto-scan, content trust, and private project RBAC.

Frequently Asked Questions about securing-container-registry-with-harbor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I block vulnerable images in Harbor registry?▼

Enable both auto_scan and prevent_vul on the project via the Harbor API, and set a severity threshold such as high or critical. With prevent_vul true, Harbor rejects pulls of images exceeding that severity after Trivy scanning completes.

How to enforce image signing with Cosign in Harbor?▼

Set enable_content_trust_cosign to true at the project level through the Harbor API, then sign images with cosign sign before pushing. Signing an image alone is not enough; the project policy must require signatures for enforcement.

Does Harbor support OIDC authentication with Okta?▼

Yes, Harbor supports oidc_auth mode with providers like Okta. Configure the OIDC endpoint, client credentials, groups claim, and admin group in Harbor settings, and enable oidc_auto_onboard to provision users automatically on first login.

Why does Harbor show no vulnerabilities for my image?▼

Images pushed before scanning was enabled, scanned against an outdated Trivy database, or built on distroless/scratch bases may report clean falsely. Check the scan timestamp and Trivy DB version via the artifact's vulnerabilities endpoint.

How do I prevent tag overwriting in Harbor?▼

Create an immutable tag rule via the Harbor API with a tag filter like v* matching your release tags. Once applied, pushing an existing matching tag is rejected, protecting release artifacts from being overwritten.

Related Skills

Explore More Software Engineering Skills→
cockroachdbcockroachdb
105

configuring-cockroachdb-helm-tls

Configures and validates TLS modes for CockroachDB Helm v2 chart deployments.

Official
Advanced
Lobbi-DocsLobbi-Docs
18

Container Security

Audit and harden container images and runtimes for vulnerabilities and misconfigurations.

Official
Advanced
adaptive-enforcement-labadaptive-enforcement-lab
3

opa-image-security-templates

Enforce Kubernetes image security policies with OPA templates.

Official
Advanced
dengineproblemdengineproblem

container-registry-setup

Configure and integrate container registries including AWS ECR, GCP Artifact Registry, Azure ACR, Docker Hub and Harbor with security and CI/CD support.

Community
Advanced