---
title: "Use Harbor or your code host's registry · Agent Wranglers"
url: https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/container-registry
id: STK-107
level: Default
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1057
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Use Harbor or your code host's registry for container images

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Delivery and infrastructure](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: STK-107
- Level: Default
- Chapter: [Delivery and infrastructure](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure.md)
- Rule: Push every image to one private registry that keeps tags immutable and scans each push. Run Harbor when you run your own servers, or use your code host's registry when you do not.
- Check: Every image in the deploy configuration names one registry and a `sha256` digest. Pushing an existing tag again to that registry is refused.
- Review by: 2027-04-30
- Cost: Open source. Harbor is Apache-2.0 and free to run yourself. GitHub Container Registry is a free tier, free for public images.
- How: Harbor passes the five tests. Its first stable release, 1.1.0, was tagged on 15 April 2017, and 2.15.4 shipped on 9 October 2026. Its `goharbor/harbor-core` image had about 30 million pulls on Docker Hub in October 2026, and its GitHub repository about 29,600 stars. It adds projects, roles, immutable tags, image scanning and replication to another registry. GitHub Container Registry became generally available on 21 June 2021. It uses the same accounts and permissions as [Use Git on GitHub for version control and code hosting](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/git-on-github.md). CI pushes to it with the job's own token. Both speak the OCI distribution standard, so `docker push` to another host is the way out. Pull images by digest, as [Make release tags and files immutable](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/immutable-releases.md) says. Choose something else when your whole app runs in one cloud. Its own registry then sits next to the hosts and needs no extra login.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
docker build -t ghcr.io/example/shop:2.4.0 .
docker push ghcr.io/example/shop:2.4.0
docker buildx imagetools inspect ghcr.io/example/shop:2.4.0 --format '{{json .Manifest.Digest}}'
```

### Python example

```python
# Deploy check: every image is pinned by digest
import re, sys
compose = open("compose.prod.yaml").read()
images = re.findall(r"image:\s*(\S+)", compose)
unpinned = [image for image in images if "@sha256:" not in image]
print("\n".join(f"FAIL {image} is not pinned by digest" for image in unpinned))
sys.exit(1 if unpinned else 0)
```

## Sources

- [GitHub Docs on the Container registry](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry)

## Related rules

- STK-51 [Use Git on GitHub for version control and code hosting](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/git-on-github.md) in Software choices
- ENG-42 [Make release tags and files immutable](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/immutable-releases.md) in Engineering

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/container-registry">Agent Wranglers software choices playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Avoid Kubernetes until Compose and a managed container service fall short](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/avoid-early-kubernetes.md)
- Next: [Use Cloud Run or AWS Fargate when one host is not enough](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure/managed-containers.md)
- [Delivery and infrastructure](https://agentwranglers.se/playbook/stack/delivery-and-infrastructure.md)