LoginSign Up
← Back to all sparks
H

Harbor

INFRA · APIS
Velocity5.0

Open source container image registry with security scanning and RBAC

goharbor.io ↗

Harbor 2.16 RC1 brings official arm64 builds, custom project roles and smarter proxy caching.

container registryrbacproxy cachemulti-archsecurity patches
◆Current state
Harbor spent September and October on security patch candidates and rolling back defaults that broke webhooks and legacy signer pulls. The first 2.16.0 candidate is the first feature release in that window. It adds full amd64 and arm64 builds, custom project roles in the UI, proxy-cache repository filters and referrer API proxying, and member audit events.
◆Where it's heading
The 2.16 line shifts Harbor from patching toward enterprise registry features: finer RBAC, deeper audit trails, and a proxy cache that handles OCI referrers such as signatures and SBOMs. Multi-arch builds make Harbor a straightforward fit for arm64 clusters. Security fixes keep landing alongside, so the 2.14 and 2.15 patch lines will likely continue.
◆Prediction
Expect further 2.16.0 release candidates before GA, plus more 2.14.x and 2.15.x patch tags. Whether custom roles get a matching API-level story is not yet clear from these notes.

◆Recent moves

  1. 2d ago

    2.16.0 RC1: arm64 builds, custom project roles, proxy-cache filters

    The first 2.16 candidate ends months of patch-only releases with real features: official arm64 builds, custom project roles in the UI, proxy-cache repository filters, and referrer API proxying to upstream registries. Cache hit/miss metrics and member audit events round it out. It is a substantial minor, still at RC stage.

    View source ↗
  2. 7d ago

    2.14.6 RC2: Go CVE fixes and decompression limit

    The second 2.14.6 candidate adds Go CVE upgrades and a decompression byte limit on top of RC1's webhook and signer-pull rollbacks. It shows the 2.14 line still getting both security fixes and regression repairs.

    View source ↗
  3. 16d ago

    2.14.6 RC1: private-network webhooks and legacy signer pulls restored

    This backports the 2.15.4 regression fixes to the 2.14 line: webhooks can reach private networks again, legacy signer pulls are allowed by default, and harbor.yml gets a switch for them. It also refreshes the bundled Trivy.

    View source ↗
  4. 21d ago

    2.15.4 RC1: rolls back webhook and signer-pull restrictions

    This walks back two security defaults that broke real deployments, so webhooks to private networks and legacy content-trust pulls work out of the box again. It pairs that with a Trivy 0.75 bump. It's the compatibility half of the hardening cycle.

    View source ↗
  5. 1mo ago

    2.15.3 RC2: security fixes for proxy cache, uploads and exports

    This finalizes the 2.15.3 security batch: manifest upload size limits, a fix for robot-name proxy-cache poisoning, neutralized CSV formulas in scan exports, and constrained registry pings. Those defaults set up the regressions the next patch had to fix.

    View source ↗
  6. 1mo ago

    2.15.3 RC1: security fix batch

    This is the first candidate of the same 2.15.3 security batch. The substantive changes are covered in RC2.

    View source ↗