Harbor optionally supports HTTP connections, however the Docker client always attempts to connect to registries by first using HTTPS. If Harbor is configured for HTTP, you must configure your Docker client so that it can connect to insecure registries. In your Docker client is not configured for insecure registries, you will see the following error when you attempt to pull or push images to Harbor:
Error response from daemon: Get https://myregistrydomain.com/v1/users/: dial tcp myregistrydomain.com:443 getsockopt: connection refused.
You also see this error if Harbor uses HTTPS with an unknown CA certificate. In this case, obtain the registry’s CA certificate, and copy it to /etc/docker/certs.d/myregistrydomain.com/ca.crt.
Harbor only supports the Registry V2 API. You must use Docker client 1.6.0 or higher when pushing and pulling images.
If the project that the image belongs to is private, you must sign in first:
docker login <harbor_address>
You can now pull an image:
docker pull <harbor_address>/library/ubuntu:14.04
You cannot pull an unsigned image if you have enabled content trust.
Before you can push an image to Harbor, you must create a corresponding project in the Harbor interface. For information about how to create a project, see
First, log in from Docker client:
docker login <harbor_address>
Tag the image:
docker tag ubuntu:14.04 <harbor_address>/demo/ubuntu:14.04
Push the image:
docker push <harbor_address>/demo/ubuntu:14.04
Add Descriptions to Repositories
After pushing an image, the project administrator can add information to describe the repository.
Go into the repository and select the Info tab, and click the Edit button. Enter a description and click Save to save the description.
Download the Harbor Certificate
Users can click the Registry Certificate button to download the registry certificate.
Deleting a repository involves two steps.
First, you delete the repository in the Harbor interface. You can delete the entire repository or just one of its tags. This is soft deletion. After the soft deletion, the repository is no longer managed by Harbor, but the repository files remain in the Harbor storage.
If multiple tags refer to the same image, then deleting one tag results in the deletion of all tags for that image. For example, if both tag A and tag B refer to the same image, then when you delete tag A, tag B is also deleted. If you enabled content trust, you need to use the notary command-line tool to delete the tag’s signature before you delete an image.
Next, after you delete the repository in the Harbor interface, you can delete the repository files by running
garbage collection in the Harbor interface.
Pulling Images from Harbor in Kubernetes
Kubernetes users can easily deploy pods with images stored in Harbor. The settings are similar to those of any other private registry. There are two issues to be aware of:
Make sure that https is enabled in harbor.yml and the attributes ssl_cert and ssl_cert_key point to valid certificates. For more information about generating an HTTPS certificate, see
Configure HTTPS Access to Harbor.
Copy the Root Certificate
If Harbor instance is hosted at 192.168.0.5, ff you are using a self-signed certificate, copy the Harbor CA root cert to /etc/docker/certs.d/192.168.0.5/ and ~/.docker/tls/192.168.0.5:4443/ on the machine on which you run the Docker client.
Enable Docker Content Trust
You can enable content trust by setting the following environment variables on the machine on which you run the Docker client.
By default, the local directory for storing meta files for the Notary client is different from the one for the Docker client. To simplify the use of the Notary client to manipulate the keys/meta files that are generated by Docker content trust, you can set an alias.