Google Distributed Cloud (GDC) air-gapped Managed Harbor Service (MHS) is a fully managed service that lets you store and manage container images, even in air-gapped environments completely isolated from the internet or other networks. Harbor is an open source registry that secures artifacts with policies and role-based access control, ensuring images are scanned, free from vulnerabilities, and images are signed as trusted.
GDC MHS provides control-plane operations, such as creating and deleting Harbor registry instances. It enables GDC MHS data-plane operations like pushing and pulling container images. Pushing your container images to a container registry solution like Harbor provides a centralized, secure, scalable, and efficient way to store, manage, and deploy your Docker images.
Harbor is a Cloud Native Computing Foundation (CNCF) graduated open source project that provides a built-in cloud container registry solution for Kubernetes and Docker. With managed service integration, customers can deploy their own Harbor instance to store and manage their artifacts on GDC MHS offers the following features:
- Harbor instances are automatically provisioned and managed by GDC.
- Harbor is integrated with GDC's IAM and observability systems.
- Harbor instances can be upgraded to the newer stable version.
- Harbor is enhanced to meet GDC's compliance and quality requirements.
Performance
MHS has been tested and verified to support the limits specified on this page. The actual performance limits might be higher.
MHS supports the following performance limits:
- Up to five Harbor instances in an organization. Only one instance is permitted per user project.
- Harbor has a limit of 128 GB per layer. Don't try to push layers larger than 128 GB.
- Up to 1 TB in total storage. This storage limit might vary depending on the total storage available in object storage.
- Handle at least 30 concurrent requests at a given time for various artifact sizes, from 1 KB to 1 GB.
Garbage collection
When you use MHS to add images to and delete images from the registry, unused data can build up over time. To avoid straining storage resources, MHS automatically performs garbage collection every 12 hours. You don't have to configure garbage collection manually.
What's next
To enable MHS, you must create a Harbor instance in your project.