Welcome to MSR#
Mirantis Secure Registry (MSR) is a private container registry for Kubernetes, based on Harbor. Learn how to use MSR to secure your software supply chain, distribute images across environments, and operate the registry day to day.
Security and Compliance#
-
Access Control
Organize images and other artifacts into projects to share them across your company while keeping clear boundaries between teams. Control who can access each project through role-based access control (RBAC), with users authenticated through LDAP or OIDC.
-
Vulnerability Scanning
Scan images for known vulnerabilities before you deploy them to production. Trivy is the default scanner, and you can integrate other scanners such as Grype and Anchore.
-
Image Signing
Sign and verify artifacts with Cosign or Notation (Notary v2), including keyless signing with OIDC identities. Signatures are stored alongside the artifacts they sign.
-
SBOMs
Store and distribute Software Bills of Materials (SBOMs) in SPDX and CycloneDX formats as OCI artifacts, for automated compliance checks and dependency transparency.
Distribution#
-
Replication
Replicate images and artifacts to and from OCI-compatible registries, such as Docker Registry, MSR, Harbor, and so on, to support hybrid and multi-cloud workflows.
-
Proxy Caching
Cache images from upstream registries to reduce bandwidth usage and speed up image pulls. You can apply speed limits to control network usage.
-
Image Preheating
Pull frequently used images to nodes in advance with Dragonfly or Kraken to reduce startup times for large workloads. Both distribute images peer-to-peer (P2P) across clusters.
-
AI Model Storage
Store, version, and distribute ML models as OCI artifacts in the same registry as your container images.
Operations#
-
Storage Management
Set project-level storage quotas to enforce usage limits across teams, and define tag retention rules that keep or remove image tags based on tag patterns, repositories, labels, or image age. Together, they prevent uncontrolled registry growth and clean up outdated images.
-
Backup and Restore
Back up and restore Kubernetes resources and persistent volumes with Velero, using full or incremental filesystem and snapshot backups to S3-compatible storage such as MinIO, and restore to a separate cluster for disaster recovery.
-
Webhooks
Notify HTTP or Slack endpoints when artifacts are pushed, pulled, deleted, scanned, or replicated, so that your CI/CD and security tools can act on registry events.
-
Audit Logging
Record UI and API actions, including user activity, system events, and admin operations, in structured logs that you can forward to centralized logging and SIEM tools.