DEV Community

yutianle
yutianle

Posted on

57,029 Harbor Registries Online: An Artefact Store Is a Deployment Authority

#harbor #exposure #supplychain

57,029 Harbor Registries Online: An Artefact Store Is a Deployment Authority

A container registry holds the images that a platform will run. Control of a registry is therefore control of deployment, and the exposure question is not only whether the store is readable but whether an unauthenticated user can push.

What the project provides

Harbor is an open source registry that adds role-based access control, project isolation, image scanning integration and replication on top of a container registry implementation. Its documentation describes the role model, the project structure and the deployment options, including the recommendation to place the interface behind TLS.
The authority model is what makes the exposure interesting. Reading a project's images describes what the organisation runs and in some configurations reveals environment variables baked into layers. Pushing to a project that a deployment tool trusts is a path to running code inside the estate without touching an application.

The measurement

One query was run against the international dataset on 2026-09-27 with the default all asset scope:

app="Harbor"
Enter fullscreen mode Exit fullscreen mode

Observed result: 57,029 matching services.
A single fingerprint figure is used here rather than a port comparison, because Harbor's default interface shares a port with the generic registry protocol and a port query would mix two different products. The fingerprint is specific enough to describe the population.
The count describes services presenting a Harbor fingerprint. It does not indicate whether the project is public, whether anonymous pull is enabled, whether anonymous push is possible, or whether the registry is reachable from an untrusted network in the organisation's specific context.

Where the risk concentrates

Three configurations turn an exposed registry into a deployment path.
A project configured for public access where the intended setting was internal, which makes images readable. The damage in that case depends on what was baked into the layers.
A deployment pipeline that authenticates with a long-lived robot account whose scope covers multiple projects, so a single leaked credential reaches every one of them.
A registry served over plain HTTP where a build system pulls from it, which exposes both the authentication and the image content to anyone on the path.
None of these is detectable from the fingerprint. All three are answerable from the registry's own configuration.

Checks that belong in a container platform review

  1. Confirm the registry is reachable only from the build and runtime networks that need it.
  2. Confirm that anonymous access is disabled at the system level and re-enabled only per project where there is a reason.
  3. Confirm that robot accounts are scoped per project and rotated, and that their expiry is set.
  4. Confirm TLS is enforced and that certificate validation is not disabled on the client side for convenience.
  5. Confirm that image scanning results are reviewed before deployment, because a registry without scanning is a distribution point for whatever was pushed. Point three is the one that most often fails a review, and it is the difference between a leaked credential affecting one project and affecting the estate.

Applying the measurement to an organisation's own registries

The product fingerprint and the surrounding queries are available from https://www.zoomeye.ai/. The productive use is to run the query against the organisation's own ranges and autonomous systems, and to compare the result with an internal registry inventory. A registry that appears in the external result and not in the inventory is a distribution point that nobody is watching.
Where a registry is confirmed to be externally reachable, the follow-up question is not how many images are stored, but who can push to it, and that answer comes from the registry's configuration rather than from a search engine.
ZoomEye's product field makes this scoping possible in a single query, and recording the field name with the count is what keeps the figure reproducible.

References

Top comments (0)