Harbor vs Docker Hub: Self-Hosted vs Public Registry
Harbor is a self-hosted, CNCF container registry with built-in scanning, signing, and RBAC; Docker Hub is the public hosted registry and image marketplace.
Harbor is an open-source, self-hosted registry adding vulnerability scanning, image signing, replication, and fine-grained RBAC - aimed at enterprises that want control. Docker Hub is the default public registry hosting official and community images, with private repos and convenience, but rate limits and less in-house governance.
| Harbor | Docker Hub | |
|---|---|---|
| Hosting | Self-hosted | Public SaaS |
| Scanning / signing | Built-in | Limited / add-on |
| RBAC | Fine-grained | Basic |
| Replication | Yes | Limited |
| Best for | Enterprise control | Public images, quick start |
In CI
Docker Hub is convenient for pulling base and public images and quick private hosting, but watch pull rate limits in CI. Harbor gives you a registry you control with scanning, signing, RBAC, and replication - strong for security-conscious or air-gapped pipelines. Many teams proxy Docker Hub through Harbor to cache images and avoid rate limits.
Speed it up
Cache and proxy upstream images to dodge pull limits and warm layers. Pulls and pushes run on CI runners; faster managed runners shorten image-heavy steps.
Decide with your own numbers, not a feature table
Feature comparisons age badly and rarely decide anything, because both tools in a mature category can do the job. What differs is how each behaves on your repository, and that takes one afternoon to measure.
# time a cold install with each candidate, cache cleared
hyperfine --prepare "rm -rf node_modules" --warmup 1 \
"<tool-a> install" "<tool-b> install"
# and the thing CI actually pays for: a cold run with no local cache
docker run --rm -v "$(pwd):/w" -w /w node:22 sh -c "<tool> install"What actually changes when you switch
- Lockfile format. A switch is a one-way door for anyone still on the old tool until everyone migrates, so plan it as a single coordinated change.
- Resolution strictness. Tools differ on whether an undeclared transitive import works, and the stricter one will surface latent bugs as new failures.
- CI cache configuration. The cache path and key differ per tool; carrying over the old ones silently disables caching.
- Everyone on the team and every runner must move together. Pin the version so they cannot drift.
The verdict
Want a controlled registry with scanning, signing, and RBAC: Harbor. Want the public registry for base/community images and quick hosting: Docker Hub. Pull-limit pain in CI often pushes teams to proxy Hub via Harbor.