version: '2.3' services: log: image: goharbor/harbor-log:{{version}} container_name: harbor-log restart: always dns_search: . cap_drop: - ALL cap_add: - CHOWN - DAC_OVERRIDE - SETGID - SETUID volumes: - {{log_location}}/:/var/log/docker/:z - type: bind source: ./common/config/log/logrotate.conf target: /etc/logrotate.d/logrotate.conf - type: bind source: ./common/config/log/rsyslog_docker.conf target: /etc/rsyslog.d/rsyslog_docker.conf ports: - 127.0.0.1:1514:10514 networks: - harbor registry: image: goharbor/registry-photon:{{reg_version}} container_name: registry restart: always cap_drop: - ALL cap_add: - CHOWN - SETGID - SETUID volumes: - {{data_volume}}/registry:/storage:z - ./common/config/registry/:/etc/registry/:z - type: bind source: {{data_volume}}/secret/registry/root.crt target: /etc/registry/root.crt - type: bind source: ./common/config/shared/trust-certificates target: /harbor_cust_cert {% if gcs_keyfile %} - type: bind source: {{gcs_keyfile}} target: /etc/registry/gcs.key {% endif %} {%if internal_tls.enabled %} - type: bind source: {{internal_tls.core_crt_path}} target: /harbor_cust_cert/core.crt - type: bind source: {{internal_tls.registry_crt_path}} target: /etc/harbor/tls/registry.crt - type: bind source: {{internal_tls.registry_key_path}} target: /etc/harbor/tls/registry.key {% endif %} networks: - harbor {% if with_clair %} - harbor-clair {% endif %} dns_search: . depends_on: - log logging: driver: "syslog" options: syslog-address: "tcp://127.0.0.1:1514" tag: "registry" registryctl: image: goharbor/harbor-registryctl:{{version}} container_name: registryctl env_file: - ./common/config/registryctl/env restart: always cap_drop: - ALL cap_add: - CHOWN - SETGID - SETUID volumes: - {{data_volume}}/registry:/storage:z - ./common/config/registry/:/etc/registry/:z - type: bind source: ./common/config/registryctl/config.yml target: /etc/registryctl/config.yml - type: bind source: ./common/config/shared/trust-certificates target: /harbor_cust_cert {% if gcs_keyfile %} - type: bind source: {{gcs_keyfile}} target: /etc/registry/gcs.key {% endif %} {%if internal_tls.enabled %} - type: bind source: {{internal_tls.registryctl_crt_path}} target: /etc/harbor/ssl/registryctl.crt - type: bind source: {{internal_tls.registryctl_key_path}} target: /etc/harbor/ssl/registryctl.key {% endif %} networks: - harbor dns_search: . depends_on: - log logging: driver: "syslog" options: syslog-address: "tcp://127.0.0.1:1514" tag: "registryctl" {% if external_database == False %} postgresql: image: goharbor/harbor-db:{{version}} container_name: harbor-db restart: always cap_drop: - ALL cap_add: - CHOWN - DAC_OVERRIDE - SETGID - SETUID volumes: - {{data_volume}}/database:/var/lib/postgresql/data:z networks: harbor: {% if with_notary %} harbor-notary: aliases: - harbor-db {% endif %} {% if with_clair %} harbor-clair: aliases: - harbor-db {% endif %} dns_search: . env_file: - ./common/config/db/env depends_on: - log logging: driver: "syslog" options: syslog-address: "tcp://127.0.0.1:1514" tag: "postgresql" {% endif %} core: image: goharbor/harbor-core:{{version}} container_name: harbor-core env_file: - ./common/config/core/env restart: always cap_drop: - ALL cap_add: - SETGID - SETUID volumes: - {{data_volume}}/ca_download/:/etc/core/ca/:z - {{data_volume}}/:/data/:z - ./common/config/core/certificates/:/etc/core/certificates/:z - type: bind source: ./common/config/core/app.conf target: /etc/core/app.conf - type: bind source: {{data_volume}}/secret/core/private_key.pem target: /etc/core/private_key.pem - type: bind source: {{data_volume}}/secret/keys/secretkey target: /etc/core/key - type: bind source: ./common/config/shared/trust-certificates target: /harbor_cust_cert {% if uaa_ca_file %} - type: bind source: {{uaa_ca_file}} target: /etc/core/certificates/uaa_ca.pem {% endif %} {%if internal_tls.enabled %} - type: bind source: {{internal_tls.core_crt_path}} target: /etc/harbor/ssl/core.crt - type: bind source: {{internal_tls.core_key_path}} target: /etc/harbor/ssl/core.key {% endif %} networks: harbor: {% if with_notary %} harbor-notary: {% endif %} {% if with_clair %} harbor-clair: aliases: - harbor-core {% endif %} {% if with_chartmuseum %} harbor-chartmuseum: aliases: - harbor-core {% endif %} dns_search: . depends_on: - log - registry {% if external_redis == False %} - redis {% endif %} {% if external_database == False %} - postgresql {% endif %} logging: driver: "syslog" options: syslog-address: "tcp://127.0.0.1:1514" tag: "core" portal: image: goharbor/harbor-portal:{{version}} container_name: harbor-portal restart: always cap_drop: - ALL cap_add: - CHOWN - SETGID - SETUID - NET_BIND_SERVICE networks: - harbor dns_search: . depends_on: - log logging: driver: "syslog" options: syslog-address: "tcp://127.0.0.1:1514" tag: "portal" jobservice: image: goharbor/harbor-jobservice:{{version}} container_name: harbor-jobservice env_file: - ./common/config/jobservice/env restart: always cap_drop: - ALL cap_add: - CHOWN - SETGID - SETUID volumes: - {{data_volume}}/job_logs:/var/log/jobs:z - type: bind source: ./common/config/jobservice/config.yml target: /etc/jobservice/config.yml - type: bind source: ./common/config/shared/trust-certificates target: /harbor_cust_cert {%if internal_tls.enabled %} - type: bind source: {{internal_tls.job_service_crt_path}} target: /etc/harbor/ssl/job_service.crt - type: bind source: {{internal_tls.job_service_key_path}} target: /etc/harbor/ssl/job_service.key {% endif %} networks: - harbor {% if with_clair %} - harbor-clair {% endif %} dns_search: . depends_on: - core logging: driver: "syslog" options: syslog-address: "tcp://127.0.0.1:1514" tag: "jobservice" {% if external_redis == False %} redis: image: goharbor/redis-photon:{{redis_version}} container_name: redis restart: always cap_drop: - ALL cap_add: - CHOWN - SETGID - SETUID volumes: - {{data_volume}}/redis:/var/lib/redis networks: harbor: {% if with_chartmuseum %} harbor-chartmuseum: aliases: - redis {% endif %} {% if with_clair %} harbor-clair: aliases: - redis {% endif %} dns_search: . depends_on: - log logging: driver: "syslog" options: syslog-address: "tcp://127.0.0.1:1514" tag: "redis" {% endif %} proxy: image: goharbor/nginx-photon:{{version}} container_name: nginx restart: always cap_drop: - ALL cap_add: - CHOWN - SETGID - SETUID - NET_BIND_SERVICE volumes: - ./common/config/nginx:/etc/nginx:z {% if protocol == 'https' %} - {{data_volume}}/secret/cert:/etc/cert:z {% endif %} - type: bind source: ./common/config/shared/trust-certificates target: /harbor_cust_cert {%if internal_tls.enabled %} - type: bind source: {{internal_tls.proxy_crt_path}} target: /etc/harbor/tls/proxy.crt - type: bind source: {{internal_tls.proxy_key_path}} target: /etc/harbor/tls/proxy.key {% endif %} networks: - harbor {% if with_notary %} - harbor-notary {% endif %} dns_search: . ports: - {{http_port}}:8080 {% if protocol == 'https' %} - {{https_port}}:8443 {% endif %} {% if with_notary %} - 4443:4443 {% endif %} depends_on: - registry - core - portal - log logging: driver: "syslog" options: syslog-address: "tcp://127.0.0.1:1514" tag: "proxy" {% if with_notary %} notary-server: image: goharbor/notary-server-photon:{{notary_version}} container_name: notary-server restart: always networks: - notary-sig - harbor-notary dns_search: . volumes: - ./common/config/notary:/etc/notary:z - type: bind source: {{data_volume}}/secret/notary/notary-signer-ca.crt target: /etc/notary/notary-signer-ca.crt - type: bind source: {{data_volume}}/secret/registry/root.crt target: /etc/notary/root.crt - type: bind source: ./common/config/shared/trust-certificates target: /harbor_cust_cert {%if internal_tls.enabled %} - type: bind source: {{internal_tls.notary_server_crt_path}} target: /etc/harbor/ssl/notary_server.crt - type: bind source: {{internal_tls.notary_server_key_path}} target: /etc/harbor/ssl/notary_server.key {% endif %} env_file: - ./common/config/notary/server_env depends_on: {% if external_database == False %} - postgresql {% endif %} - notary-signer logging: driver: "syslog" options: syslog-address: "tcp://127.0.0.1:1514" tag: "notary-server" notary-signer: image: goharbor/notary-signer-photon:{{notary_version}} container_name: notary-signer restart: always networks: harbor-notary: notary-sig: aliases: - notarysigner dns_search: . volumes: - ./common/config/notary:/etc/notary:z - type: bind source: {{data_volume}}/secret/notary/notary-signer.crt target: /etc/notary/notary-signer.crt - type: bind source: {{data_volume}}/secret/notary/notary-signer.key target: /etc/notary/notary-signer.key - type: bind source: ./common/config/shared/trust-certificates target: /harbor_cust_cert {%if internal_tls.enabled %} - type: bind source: {{internal_tls.notary_signer_crt_path}} target: /etc/harbor/ssl/notary_signer.crt - type: bind source: {{internal_tls.notary_signer_key_path}} target: /etc/harbor/ssl/notary_signer.key {% endif %} env_file: - ./common/config/notary/signer_env depends_on: - log {% if external_database == False %} - postgresql {% endif %} logging: driver: "syslog" options: syslog-address: "tcp://127.0.0.1:1514" tag: "notary-signer" {% endif %} {% if with_clair %} clair: networks: - harbor-clair container_name: clair image: goharbor/clair-photon:{{clair_version}} restart: always cap_drop: - ALL cap_add: - DAC_OVERRIDE - SETGID - SETUID cpu_quota: 50000 dns_search: . depends_on: - log {% if external_database == False %} - postgresql {% endif %} volumes: - type: bind source: ./common/config/clair/config.yaml target: /etc/clair/config.yaml - type: bind source: ./common/config/shared/trust-certificates target: /harbor_cust_cert {%if internal_tls.enabled %} - type: bind source: {{internal_tls.clair_crt_path}} target: /etc/harbor/ssl/clair.crt - type: bind source: {{internal_tls.clair_key_path}} target: /etc/harbor/ssl/clair.key {% endif %} logging: driver: "syslog" options: syslog-address: "tcp://127.0.0.1:1514" tag: "clair" env_file: ./common/config/clair/clair_env clair-adapter: networks: - harbor-clair container_name: clair-adapter image: goharbor/clair-adapter-photon:{{clair_adapter_version}} restart: always cap_drop: - ALL cap_add: - DAC_OVERRIDE - SETGID - SETUID cpu_quota: 50000 dns_search: . depends_on: - clair {% if external_redis == False %} - redis {% endif %} volumes: - type: bind source: ./common/config/shared/trust-certificates target: /harbor_cust_cert {%if internal_tls.enabled %} - type: bind source: {{internal_tls.clair_adapter_crt_path}} target: /etc/harbor/ssl/clair_adapter.crt - type: bind source: {{internal_tls.clair_adapter_key_path}} target: /etc/harbor/ssl/clair_adapter.key {% endif %} logging: driver: "syslog" options: syslog-address: "tcp://127.0.0.1:1514" tag: "clair-adapter" env_file: ./common/config/clair-adapter/env {% endif %} {% if with_trivy %} trivy-adapter: container_name: trivy-adapter image: goharbor/trivy-adapter-photon:{{trivy_adapter_version}} restart: always cap_drop: - ALL dns_search: . networks: - harbor {% if external_redis == False %} depends_on: - redis {% endif %} volumes: - type: bind source: {{data_volume}}/trivy-adapter/trivy target: /home/scanner/.cache/trivy - type: bind source: {{data_volume}}/trivy-adapter/reports target: /home/scanner/.cache/reports - type: bind source: ./common/config/shared/trust-certificates target: /harbor_cust_cert {% if internal_tls.enabled %} - type: bind source: {{internal_tls.trivy_adapter_crt_path}} target: /etc/harbor/ssl/trivy_adapter.crt - type: bind source: {{internal_tls.trivy_adapter_key_path}} target: /etc/harbor/ssl/trivy_adapter.key {% endif %} logging: driver: "syslog" options: syslog-address: "tcp://127.0.0.1:1514" tag: "trivy-adapter" env_file: ./common/config/trivy-adapter/env {% endif %} {% if with_chartmuseum %} chartmuseum: container_name: chartmuseum image: goharbor/chartmuseum-photon:{{chartmuseum_version}} restart: always cap_drop: - ALL cap_add: - CHOWN - DAC_OVERRIDE - SETGID - SETUID networks: - harbor-chartmuseum dns_search: . depends_on: - log volumes: - {{data_volume}}/chart_storage:/chart_storage:z - ./common/config/chartserver:/etc/chartserver:z - type: bind source: ./common/config/shared/trust-certificates target: /harbor_cust_cert {%if internal_tls.enabled %} - type: bind source: {{internal_tls.chartmuseum_crt_path}} target: /etc/harbor/ssl/chartmuseum.crt - type: bind source: {{internal_tls.chartmuseum_key_path}} target: /etc/harbor/ssl/chartmuseum.key {% endif %} {% if gcs_keyfile %} - type: bind source: {{gcs_keyfile}} target: /etc/chartserver/gcs.key {% endif %} logging: driver: "syslog" options: syslog-address: "tcp://127.0.0.1:1514" tag: "chartmuseum" env_file: ./common/config/chartserver/env {% endif %} networks: harbor: external: false {% if with_notary %} harbor-notary: external: false notary-sig: external: false {% endif %} {% if with_clair %} harbor-clair: external: false {% endif %} {% if with_chartmuseum %} harbor-chartmuseum: external: false {% endif %}