How to use Harbor to increase security on your platform
By: Alex Vazquez
Tags: Software Development, Technology, Software Engineering, Containers, DevOps

How to use Harbor to increase security on your platform

Learn how you can include Harbor in your DevSecOps toolset to increase the security and management on your container-based platform

Photo by Youngje Park on Unsplash

With the transition to a more agile development process where the number of deployment has been increased in an exponential way. That situation has made quite complex to keep the pace to make sure we’re not just deploying code more often into production that provides the capabilities that are required by the business. But, also, at the same time, we’re able to do it securely and safely.

That need is leading towards the DevSecOps idea to include security as part of the DevOps culture and practices to a way to ensure the safety since the beginning on the development and across all the standard steps from the developer machine to the production environment.

Additional to that, because of the container paradigm we have a more polyglot approach with different kinds of components running on our platform using a different base image, packages, libraries, and so on. We need to make sure they’re still secure to use and we need tools to be able to govern that in a natural way. To help us on that duty is where components like Harbor help us to do that.

Harbor is a CNCF project at the incubator stage at the moment of writing this article, and it provides several capabilities regarding how to manage the container images for a project perspective. It gives a project approach with its docker registry and also a chart museum if we’d like to use Helm Charts as part of our project development. But it includes security features too, and that’s the one that we’re going to cover in this article:

Vulnerabilities Scan: it allows you to scan all the docker images registered in the different repositories to check if they have vulnerabilities. It also provides automation during that process to make sure that every time we push a new image, this is scanned automatically. Also, it will enable defining policies to avoid pulling any image with vulnerabilities and also set the level of vulnerabilities (low, medium, high, or critical) that we’d like to tolerate it. By default, it comes with Clair as the default scanner, but you can introduce others as well.

it allows you to scan all the docker images registered in the different repositories to check if they have vulnerabilities. It also provides automation during that process to make sure that every time we push a new image, this is scanned automatically. Also, it will enable defining policies to avoid pulling any image with vulnerabilities and also set the level of vulnerabilities (low, medium, high, or critical) that we’d like to tolerate it. By default, it comes with Clair as the default scanner, but you can introduce others as well. Signed images: Harbor provides options to deploy notary as part of its components to be able to sign image during the push process to make sure that no modifications are done to that image

Harbor provides options to deploy notary as part of its components to be able to sign image during the push process to make sure that no modifications are done to that image Tag Inmuttability and Retention Rules: Harbor also provides the option to define tag immutability and retention rules to make sure that we don’t have any attempt to replace images with others using the same tag.

Harbor is based on docker so you can run it locally using docker and docker-compose using the procedure that it is available on its official web page. But it also supports to be installed on top of your Kubernetes platform using the helm chart and operator that is available.

Once the tool is installed, we have access to the UI Web Portal, and we’re able to create a project that has repositories as part of it.

Project List inside the Harbor Portal UI

As part of the project configuration, we can define the security policies that we’d like to provide to each project. That means that different projects can have different security profiles.

Security settings inside a Project in Harbor Porta UI

And once we push a new image to the repository that belongs to that project we’re going to see the following details:

In this case, I’ve pushed a TIBCO BusinessWorks Container Edition application that doesn’t contain any vulnerability and just shows that and also where this was checked.

Also, if we see the details, we can check additional information like if the image has been signed or not, or be able to check it again.

Image details inside Harbor Portal UI

Summary

So, this is just a few features that Harbor provides from the security perspective. But Harbor is much more than only that so probably we cover more of its features in further articles and I hope based on what you read today you’d like to give it a chance and start introducing it in your DevSecOps toolset.