Use Harbor or your code host's registry for container images

Review by

2027-04-30

How to do it

Harbor passes the five tests. Its first stable release, 1.1.0, was tagged on 15 April 2017, and 2.15.4 shipped on 9 October 2026. Its goharbor/harbor-core image had about 30 million pulls on Docker Hub in October 2026, and its GitHub repository about 29,600 stars. It adds projects, roles, immutable tags, image scanning and replication to another registry. GitHub Container Registry became generally available on 21 June 2021. It uses the same accounts and permissions as Use Git on GitHub for version control and code hosting. CI pushes to it with the job's own token. Both speak the OCI distribution standard, so docker push to another host is the way out. Pull images by digest, as Make release tags and files immutable says. Choose something else when your whole app runs in one cloud. Its own registry then sits next to the hosts and needs no extra login.

Examples

Shell example

docker build -t ghcr.io/example/shop:2.4.0 .
docker push ghcr.io/example/shop:2.4.0
docker buildx imagetools inspect ghcr.io/example/shop:2.4.0 --format '{{json .Manifest.Digest}}'

Python example

# Deploy check: every image is pinned by digest
import re, sys
compose = open("compose.prod.yaml").read()
images = re.findall(r"image:\s*(\S+)", compose)
unpinned = [image for image in images if "@sha256:" not in image]
print("\n".join(f"FAIL {image} is not pinned by digest" for image in unpinned))
sys.exit(1 if unpinned else 0)

How to check

Every image in the deploy configuration names one registry and a sha256 digest. Pushing an existing tag again to that registry is refused.

Sources

• GitHub Docs on the Container registry

Related rules

• STK-51 Use Git on GitHub for version control and code hosting in Software choices
• ENG-42 Make release tags and files immutable in Engineering