Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Running our Docker registry on-prem with Harbor

dev.37signals.com

Post reply on HN
Print view View original

71–78 of 78 posts

Re: Running our Docker registry on-prem with Harbor

#71

Post by ticklyjunk »

muhehe wrote: post #17

This looks nice. What would be good on-prem S3 companion for this? I know if minio but I think there was some recent drama about it (I don't know specifics, just a feeling)

We are using deepspace storage for this. We can get/put objects into the cloud as one of our target volumes. It works as an auto archive writing anything in the fs that is over 90 to a compressed object and leaving behind a stub. You can point Harbor (or other tools like Mimir/Loki ) to a DeepSpace endpoint which looks like a standard S3 target. Then add policies and the files get moved, replicated, versioned to tape, cloud, disk array in the background. The users just interact with the file system as usual and admins have a UI with a catalog which shows where everything actually is.

Re: Running our Docker registry on-prem with Harbor

#72

Post by nchmy »

Symbiote wrote: post #70
nchmy wrote: post #61

Earlier quoted context omitted.

> the marginal cost of 2, 4 or 8 cores and 4, 8 or 16GB RAM isn't much when we buy our own hardware this is the crux of it all. RENTING bare metal (eg from hetzner) is 10x cheaper than aws ec2. So, I can only imagine how much cheaper it is when you buy the hardware directly.

At a very rough estimate with Hetzner's calculator, which doesn't have exactly the systems I most recently bought, our servers cost about 18 months of renting the closest Hetzner dedicated server. Add to that rackspace costs, staff time doing installation (or cost of remote hands etc). I don't have our figures for rackspace costs, but staff time is fairly low — an hour or two when the server is purchased and later th…

Amazing. So it isn't so much that Hetzner is crazy cheap, but that everyone else is crazy expensive

Re: Running our Docker registry on-prem with Harbor

#73

Post by vergessenmir »

lijok wrote: post #35

We self-host Harbor as well, it’s fairly painless. Has SSO out of the box, a Terraform provider that covers everything, and for the most part just works. The issues we’ve had so far: - No programmatic way to retrieve your token that’s required for ‘docker login’. So we had to create a robot account per user and pop their creds into our secrets store. - Migrating between sites by cloning the underlying S3 bucket and s…

Harbor has its pain points but it is infinitely easier to get up and running compared to crufty Artifactory.

One glaring omission is lack of support for proxy docker.io without the project name i.e pulling nginx:latest instead of /myproject/nginx/nginx:latest

The workaround involves URL rewrite magic in your proxy of choice

Re: Running our Docker registry on-prem with Harbor

#74

Post by benterix »

p_l wrote: post #39
lijok wrote: post #32

Earlier quoted context omitted.

We just went through this whole Kustomize shenanigan in our company. Seems completely asinine. Why not just fork the chart, fix it yourself?

... or the quite common case, make helm write the template once, fix, port to your own process, delete helm, live happy

> live happy

Until the next major upgrade.

Re: Running our Docker registry on-prem with Harbor

#76

Post by p_l »

benterix wrote: post #74
p_l wrote: post #39

Earlier quoted context omitted.

... or the quite common case, make helm write the template once, fix, port to your own process, delete helm, live happy

> live happy Until the next major upgrade.

In my experience, an update big enough to require major rewrite, probably should require a portion of this process to figure just what is the upgrade path.

Re: Running our Docker registry on-prem with Harbor

#77

Post by tedivm »

mdaniel wrote: post #64
tedivm wrote: post #51

Earlier quoted context omitted.

The lack of OIDC support for Harbor has been the biggest annoyance for me. I'd love to be able to push from Github Actions to Harbor without needing robot users.

I was shocked to read such a thing in 2025 but either there is some nuance to your observation or your information is outdated https://goharbor.io/docs/2.13.0/administration/#:~:text=or%2...

You're mixing up Human OIDC and Machine Flow OIDC. You can use OIDC to log in as a user, but you can't use OIDC to allow federated trust from something like Github Actions.

If you can find an example of OIDC with Github Actions and Harbor I'd love to see it.

Re: Running our Docker registry on-prem with Harbor

#78

Post by fuomag9 »

cyberpunk wrote: post #31
fuomag9 wrote: post #10

Earlier quoted context omitted.

And in my experience is the only one that has RBAC and can be deployed on premise and that actually works, I’ve tried everything at this point

? GitLab?

It doesn't make any sense to deploy a full gitlab just to get a docker registry. RBAC is also associated with repositories and users in a way that is unconventional to manage
Post reply on HN