Harbor 2.15: What Shipped and Why

▶ Watch (0:24)

Harbor 2.15 is the current release. Three features came directly from community requests. First, a new option disables tags landing on S3 and other storage backends, which tightens garbage collection performance. Second, upstream proxy cache connection limits prevent Harbor from burning through Docker Hub rate limits when it acts as a proxy cache. Third, Cosign v3 signature support is now included. All three address specific operational pain points that users raised with the maintainer team.

What the Next Release Cycle Targets

▶ Watch (1:04)

Two changes are planned for the next release. Harbor will replace Redis with Valkey, targeting performance improvements in the component. The team will also expand Trivy scan results inside Harbor to surface config issues, secrets, and other findings beyond vulnerabilities. Today Harbor shows CVE counts; after this change, the full output of a Trivy scan becomes visible in the UI, giving operators more signal from scans they already run.

Harbor Satellite: Registry for Edge Devices

▶ Watch (1:38)

Harbor Satellite is a stateless, secretless, zero-trust registry built for edge devices and air-gapped environments. Its footprint is minimal by design. Baskar presented a dedicated talk on it at Kubernetes on Edge Day at 12:25 p.m. the same day. The project targets scenarios where a full Harbor instance is impractical but teams still need a local registry that syncs with a central Harbor deployment. Edge deployments with constrained hardware are the primary use case.

Harbor CLI: 100k Downloads and a Zero-CVE Workflow

▶ Watch (2:07)

Harbor CLI passed 100k downloads. It automates Harbor management and exposes configuration options that the UI does not make scriptable. The team added a zero-CVE workflow that integrates with Harbor: a single command patches container images to remove all known vulnerabilities. Baskar credited Lakshit and Patrick, both of whom started as LFX Mentorship mentees and climbed to maintainer status on the Harbor CLI project. They also handled triage during a wave of AI-generated spam pull requests.

Notable Quotes

we had like a lot of AI slop, spam PS coming in and these guys uh helped them uh to triage them, fix them Prasanth Baskar · ▶ 02:44

basically, it’s a harbor has a UI and it’s for automating the management of Harbor and to do a lot more config um in a way that is like automatable Prasanth Baskar · ▶ 02:15

Key Takeaways

  • Harbor 2.15 adds Cosign v3 support and upstream proxy cache connection limits for Docker Hub.
  • The next release replaces Redis with Valkey and surfaces full Trivy scan output inside Harbor.
  • Harbor CLI hit 100k downloads and now ships a single-command zero-CVE image patching workflow.

About the Speaker(s)

Prasanth Baskar is a Software Engineer at 8gearsAG and a core contributor to the CNCF Harbor project. He mentors new contributors through LFX Mentorship and contributes to KitOps, ORAS, and Kubernetes. He has spoken at KubeCon, OpenSSF Community Day, CNCF Meetups, and various open source events.