Docker Registry Showdown: Harbor vs GitLab vs Gitea Container Registry

Why Self-Host a Container Registry?

Docker Hub's free tier limits you to 100 pulls per 6 hours. GitHub Container Registry and AWS ECR charge for storage and bandwidth. A self-hosted registry gives you unlimited pulls, full control over image retention, and keeps your images on your own infrastructure.

Option 1: Gitea Container Registry

If you already run Gitea for Git hosting, enabling the built-in container registry is the simplest path:

# gitea/app.ini
[packages]
ENABLED = true
CHUNKED_UPLOAD_PATH = /data/tmp/package-upload

That is it. No extra containers, no extra configuration.

Using Gitea Registry

# Login
docker login git.example.com -u your-username

# Tag and push
docker tag myapp:latest git.example.com/your-username/myapp:latest
docker push git.example.com/your-username/myapp:latest

# Pull
docker pull git.example.com/your-username/myapp:latest

Pros: Zero extra infrastructure, tight Git integration, low resource usage.
Cons: No vulnerability scanning, basic garbage collection, no replication.

Option 2: Harbor

Harbor is the CNCF-graduated enterprise registry. It includes vulnerability scanning (Trivy), image signing, replication, RBAC, and audit logging.

# Download the installer
wget https://github.com/goharbor/harbor/releases/download/v2.11.0/harbor-online-installer-v2.11.0.tgz
tar xzf harbor-online-installer-v2.11.0.tgz
cd harbor

# Configure
cp harbor.yml.tmpl harbor.yml
# Edit harbor.yml to set hostname, HTTPS, admin password

# Install with Trivy scanner
./install.sh --with-trivy

Pros: Vulnerability scanning, image signing, RBAC, replication, audit logs.
Cons: Heavy (~1.5GB RAM), complex setup, 8+ containers.

Option 3: GitLab Container Registry

If you run GitLab, the registry is built-in:

# /etc/gitlab/gitlab.rb
registry_external_url 'https://registry.example.com'
gitlab_rails['registry_enabled'] = true

Pros: Seamless CI/CD integration, built-in cleanup policies.
Cons: Requires GitLab instance (~4GB RAM minimum), scanning only in paid tier.

Comparison Table

Image Signing with Cosign

Regardless of registry choice, sign your images:

# Generate a signing key
cosign generate-key-pair

# Sign an image
cosign sign --key cosign.key registry.example.com/myapp:latest

# Verify signature
cosign verify --key cosign.pub registry.example.com/myapp:latest

At TechSaaS, we use Gitea's built-in container registry. Since we already run Gitea for Git hosting, enabling the registry was a single config change. For our team size and use case, the simplicity outweighs Harbor's advanced features. We handle vulnerability scanning separately with Trivy in our CI pipeline.

Need help setting up a container registry? Contact [email protected].