System Architecture Overview
Relevant source files
The following files were used as context for generating this wiki page:
Harbor Next is a community-driven evolution of the Harbor CNCF project, serving as an open-source container registry for securing, storing, and managing OCI artifacts. It provides a robust architecture that integrates policy-based replication, role-based access control (RBAC), vulnerability scanning, and multi-architecture artifact support. Sources: README.md:9-14, README.md:16-24
The system is designed to facilitate cloud-native environments by providing a graphical portal and a comprehensive RESTful API (v2.0) for administrative operations and system integration. Sources: README.md:32-45, api/v2.0/swagger.yaml:1-12
Core Component Infrastructure
The Harbor Next architecture consists of several specialized components working in concert to manage the lifecycle of container images and OCI artifacts. These include the Core service, Jobservice, UI/Portal, and backend storage integrations.
The diagram above illustrates the high-level flow from user interaction points through the application logic to the background task processors and storage layer. Sources: README.md:32-45, src/portal/src/app/base/project/repository/artifact/artifact-additions/summary/summary.component.spec.ts:145-210
Component Descriptions
| Component | Description |
|---|---|
| Core Service | Handles authentication, authorization, and project management. |
| Portal | Angular-based graphical interface for user interaction. |
| Jobservice | Manages background tasks like replication, scanning, and GC. |
| Distribution | Based on Docker Distribution V3, handles image push/pull operations. |
| Replication | Synchronizes artifacts between multiple registry instances. |
Sources: README.md:16-45, src/portal/src/app/base/project/repository/artifact/artifact-additions/summary/summary.component.spec.ts:145-210
Replication Logic and Data Flow
Replication is a critical system feature that allows images and charts to be synchronized between Harbor and other registry providers based on defined policies. The replication flow utilizes adapters to communicate with diverse registry types. Sources: src/controller/replication/flow/stage.go:27-30, README.md:34-36
This sequence shows the stages of a replication job, from initialization and resource fetching to assembly and pushing to the destination. Sources: src/controller/replication/flow/stage.go:32-120
Namespace Flattening in Replication
The system supports complex repository structure manipulation during replication, known as namespace flattening. This logic allows users to reduce nested structures (e.g., a/b/c/img -> ns/img) during transfer. Sources: src/controller/replication/flow/stage.go:176-210
API Management and Security
Harbor Next exposes a RESTful API v2.0 for all administrative operations. This interface is documented via Swagger and handles everything from project creation to system health checks. Sources: api/v2.0/swagger.yaml:13-100
Core API Categories
- System Health:
/healthand/pingfor status monitoring. - Project/Repo Management:
/projectsand/repositoriesfor artifact organization. - Security Interrogation:
/scannersand/scansfor vulnerability management. - Identity:
/users,/usergroups, and/ldapfor authentication configuration.
Sources: api/v2.0/swagger.yaml:35-150
Security and Vulnerability Management
Security is integrated into the architecture through Vulnerability Scanning and Policy-based deployment checks. The system integrates with scanners (like Trivy) to analyze images for known CVEs. Sources: README.md:37-38, api/v2.0/swagger.yaml:620-680
Vulnerability Scanning Workflow
- Trigger: Manual, scheduled, or automatically on artifact push.
- Analysis: The scanner retrieves the artifact and matches its components against vulnerability databases.
- Reporting: Results are stored and accessible via the API/UI.
- Policy Enforcement: Prevention policies can block the deployment of artifacts exceeding a specific severity threshold.
Sources: api/v2.0/swagger.yaml:620-680, README.md:37-38
Summary
The Harbor Next architecture provides a scalable and secure foundation for artifact management. By decoupling high-performance registry operations from administrative orchestration and background job processing, the system ensures high availability and extensibility. The integration of modern OCI support and automated release pipelines enables continuous delivery for community-driven features. Sources: README.md:9-14, CONTRIBUTING.md:120-140