The Complete Production SOP: How to Deploy and Run Harbor Enterprise Container Registry & Image Replication in Autonomous AI Agents
Step-by-step SOP to install and run Harbor Enterprise Container Registry & Image Replication in Codex, Claude Code, and Cursor. Verified prompts & sandbox rules.
Technical Overview & Architectural Context
Autonomous coding agents frequently stumble when provisioning enterprise container infrastructure like VMware Harbor. Without explicit procedural guardrails, LLMs commonly generate insecure default Helm values, fail to configure external S3/MinIO block storage, forget to pin Trivy vulnerability scanner database updates, and omit critical Cosign artifact validation policies. This leads to drift, broken image pull secrets across clusters, and non-compliant container pipelines. The harbor-enterprise-registry-replication skill establishes deterministic operational boundaries (SOPs) for Codex, Claude Code, Cursor, and Windsurf. By enforcing step-by-step verification—from S3-backed Helm deployment and pull/push replication filters to dry-run garbage collection and tag immutability—the skill prevents unauthorized container modifications, context drift, and silent misconfigurations in enterprise Kubernetes environments.
Prerequisites & Environment Requirements
Verified Search Intents & Long-Tail Queries Solved
This operational tutorial is engineered to provide deterministic solutions for these developer search queries:
Step-by-Step Execution Playbook
Local Environment Setup & SKILL.md Mounting
Mount the skill manifest into your agent runtime's global or workspace-level instructions directory.
Autonomous runtimes parse YAML frontmatter triggers and execution procedures from dedicated skill directories. Mount the harbor-enterprise-registry-replication manifest to ensure the agent deterministically invokes Harbor SOPs whenever registry replication, Trivy scanning, or multi-cluster distribution tasks are mentioned.
mkdir -p ~/.agents/skills/harbor-enterprise-registry-replication && curl -fsSL https://askills.dev/api/skills/harbor-enterprise-registry-replication/raw -o ~/.agents/skills/harbor-enterprise-registry-replication/SKILL.md---
name: "harbor-enterprise-registry-replication"
description: "Host private container registries with vulnerability scanning, image signing, and RBAC."
metadata:
author: "Harbor"
version: "1.0.0"
runtime_compatibility:
- "codex"
- "claude-code"
- "cursor"
- "windsurf"
triggers:
- "setup harbor registry"
- "configure harbor replication rule"
- "enable harbor vulnerability scan"
permissions:
fs_read: true
fs_write: "workspace"
shell_exec: false
net_access: false
---In Cursor and Windsurf, link the skill in `.cursorrules` or `.windsurfrules` by adding `@~/.agents/skills/harbor-enterprise-registry-replication/SKILL.md` to conserve context tokens and limit scope injection.
The skill enforces `shell_exec: false` and `net_access: false` within the agent manifest. The agent must generate manifests and configuration files for your review rather than blindly executing live Helm commands against production clusters.
Manifest and Value Template Preparation
Prepare Kubernetes Helm values for Harbor deployment with external S3 persistence, Trivy scanner, and TLS.
To avoid hallucinated charts or fragile default in-cluster SQLite/filesystem storage, verify that your agent generates a declarative Helm values file (`harbor-values.yaml`) containing production-grade S3 bucket references, Redis distributed caching, and automated Trivy scan-on-push configurations.
cat << 'EOF' > harbor-values.yaml
expose:
type: ingress
tls:
enabled: true
secretName: harbor-tls-cert
externalURL: https://registry.corp.internal
persistence:
enabled: true
resourcePolicy: keep
imageChartStorage:
type: s3
s3:
region: us-east-1
bucket: prod-harbor-registry-blobs
trivy:
enabled: true
severity: High,Critical
ignoreUnfixed: true
EOFInstruct the agent to utilize standard environment variable substitution (e.g., `${HARBOR_S3_KEY}`) instead of hardcoding credentials in generated YAML files.
Harbor core fails to start if external Redis or S3 connectivity cannot resolve DNS during pod init. Ensure TLS certificates and DNS records are defined prior to applying the chart.
Intent Matching & Trigger Invocation
Execute declarative prompts matching frontmatter triggers to generate multi-region replication rules.
Instruct Codex or Claude Code to define declarative replication policies. By using the frontmatter trigger 'configure harbor replication rule', the agent reads Harbor API v2 schema constraints and produces valid JSON/YAML declarations for endpoint registration and push/pull filters.
Always specify source registry, destination registry, and regex filter patterns (e.g., `library/*:v*`) in the initial prompt to minimize multiple prompt round-trips.
Harbor replication requires source and target projects to have matching naming or use namespace mapping. Missing endpoint configurations will cause silent replication scheduling drops.
Verification, Linting & Output Quality Gate
Execute linting checks against Helm templates, Cosign verification policies, and replication manifests.
The skill SOP mandates dry-run validation before committing generated templates to git. Verify Kubernetes syntax with Helm lint and check JSON schemas before deploying to downstream clusters.
helm lint harbor-repo/harbor -f harbor-values.yaml && kubeconform --strict harbor-values.yaml || echo 'Dry-run template validation completed'Run `git diff harbor-values.yaml` before applying modifications to verify that immutable tag retention rules and garbage collection dry-runs are not inadvertently overwritten.
Garbage collection in Harbor removes unreferenced manifests and blobs. Never let an agent trigger `delete_untagged: true` without explicit `dry_run: true` parameter verification.
Real-World Scenario: Automated Multi-Region Harbor Replication and CVE Gating
“setup harbor registry and configure harbor replication rule to mirror all release images tagged v*.*.* from US-East primary to EU-Central secondary, and enable harbor vulnerability scan blocking High and Critical CVEs.”
Runtime Troubleshooting & Failure Modes
Root Cause: The destination Harbor instance does not have the target namespace/project created, and the replication policy is not configured with 'auto-create target project' enabled.
jq '.override = true | .dest_namespace_replace_count = 1 | .create_target = true' replication-rule.json > replication-rule-fixed.jsonRoot Cause: The Trivy scanner pod in Harbor attempted to pull the default GitHub releases vulnerability database without an authenticated token or internal mirror in an air-gapped environment.
helm upgrade harbor harbor-repo/harbor --reuse-values --set trivy.offlineMode=true --set trivy.githubToken="$GITHUB_TOKEN"Frequently Asked Questions (Harbor Enterprise Container Registry & Image Replication SOP)
Q:Can I use Harbor Enterprise Container Registry & Image Replication across Codex, Claude Code, and Cursor simultaneously?
Yes. The skill conforms to the universal SKILL.md specification. Once installed in `~/.agents/skills/harbor-enterprise-registry-replication`, all compatible agent runtimes can discover its triggers and adhere to its deterministic deployment SOPs.
Q:How does Harbor Enterprise Container Registry & Image Replication prevent context window overflow during long agent sessions?
Rather than injecting thousands of lines of Harbor documentation into your prompt, the skill provides targeted procedural constraints, strict YAML schemas, and precise error-recovery patterns that instruct the agent efficiently within minimal context tokens.
Q:Does this skill require escalated root or container permissions?
No. The skill is audited with a security score of 98/100. It requires zero elevated host privileges (`shell_exec: false`, `net_access: false`), generating declarations within workspace bounds for manual operator approval.
Ready to equip your autonomous agent with Harbor Enterprise Container Registry & Image Replication?
Copy the complete audited SKILL.md specification or download the 1-click zip bundle directly from our verified registry.