One Registry Workflow from Cloud to Edge to Air Gap
Harbor Satellite runs the same image distribution process everywhere, whether that's a regional data center, a rack on a factory floor or a site with no network at all. Assign images once. Satellite delivers them however each site can receive them.
Same Tool from Cloud to Air Gap
Every site is a satellite in the same fleet. How images reach it, live sync or a signed bundle, is a property of the site, not a separate product.
- Harbor Core
Central Harbor + Ground Control
Define groups, policies and signing keys once. The single source of truth for the whole fleet.
Source of truth
- Big Edge
Regional DC, factory floor, telco PoP
Satellite on Kubernetes with continuous replication and SPIFFE/SPIRE workload identity.
Live sync
- Small Edge
Retail store, vehicle, single-board device
Single binary with an OCI image layout on local disk. Minimal footprint, CRI mirror through a BYO registry or direct delivery to k3s.
Live sync, offline tolerant
- Air-Gapped
Classified sites, ships, OT networks
Same satellite record, same groups, same policy. Only the transport changes.
Signed bundle across a media break
Same Process, Just a Media Break
Other air-gap tools make you build a second pipeline, with separate packaging, separate inventory and separate trust. With Harbor Satellite, an air-gapped site is the same satellite in the same fleet. Ground Control produces a signed, differential OCI bundle in place of a live sync. You carry it across, the satellite verifies and imports it, and the site's state stays consistent with the fleet. When the site reconnects, replication picks up from the last applied bundle.
Harbor Satellite is the only registry solution that keeps one process across the whole spectrum. The air gap is a transport detail, not a second workflow.
| Temporary air gap | Full air gap | |
|---|---|---|
| Example | Ship at sea, remote mine, link outage | Classified network, OT zone that never connects |
| Delivery | Live sync while online. Replicated content stays on local disk. | Signed differential bundles only |
| Recovery | Resumes automatically from the last known state | Sequence chain rejects skipped or replayed bundles |
| Process | Identical: same fleet record, groups and policy | Identical: same fleet record, groups and policy |
Why Harbor Satellite
Extend your container registry to every edge location with reliability, security, and central management.
Reliability
Images are prepositioned in persistent storage at each edge location, so they stay on site when the network goes down.
Security
SPIFFE/SPIRE zero-trust identity with automatic credential rotation. No static secrets shipped to edge devices.
Fleet Management
Centrally manage image distribution across hundreds of edge locations. Group images and assign them to satellites.
Air-Gapped Ready
Same fleet, same process. Air-gapped sites import signed, differential OCI bundles. Temporarily disconnected sites keep their replicated content on local disk and resume replication on reconnect.
CRI Integration
Configure containerd, Docker, CRI-O, and Podman to use an edge BYO registry as a mirror with upstream fallback, or deliver images straight into k3s and RKE2.
Lightweight
Single binary with an ORAS-backed OCI image layout. Minimal resource footprint for constrained edge environments.
Join the Community
Harbor Satellite is part of the Harbor CNCF project. Connect with us.
CNCF Slack
Join #harbor-satellite on the CNCF Slack for questions, discussions, and support.
Join Slack Channel →Harbor Project
Harbor Satellite extends the Harbor container registry. Learn more about the broader project.
Harbor Community →