Speakers
Description
The CERN Container Registry is built on Harbor, a graduated CNCF project capable of managing a wide range of OCI artifacts. It serves use cases at CERN as well as workloads and services across WLCG, and acts as a central registry for Harbor instances running in other WLCG sites. Today, it hosts container images, Helm charts, machine-learning models, SBOMs, and numerous other artifact types. Beyond storage, versioning, and distribution, the service provides automated replication between registries, acts as a pull-through cache for external sources, and supports advanced quota and policy-driven tag-retention management. This session will give an overview of the various registry instances deployed across CERN, spanning both the general public network and the fully automated replication into the air-gapped Technical Network (TN), with particular emphasis on accelerator-sector use cases. We will then discuss how a centralized registry architecture enhances the tracking of vulnerabilities and Software Bills of Materials (SBOMs), supported by automatic scanning and on-publish generation of security metadata. Finally, we will present how runtime-level visibility was introduced to ensure timely responses to newly disclosed CVEs, even after initial artifact deployment. The talk will showcase the dashboards available in the service’s Security Hub portal and highlight the upstream contributions CERN has made to further strengthen Harbor’s capabilities.