# Amazon ECR vs Harbor

| Attribute | Amazon ECR | Harbor |
|---|---|---|
| **vioscaleAI score** | 69.8 (64% (medium)) | 65.8 (77% (high)) |
| activity.commits_last_30d | - | 58 |
| adoption.dependent_repos | - | 31 |
| adoption.github_stars | - | 29,540 |
| content.faq | `[{"answer":"Amazon ECR is a managed service that stores Docker container images and OCI artifacts with high availability. It integrates with AWS compute services, offers both private and public repositories, and includes built-in encryption, access controls via IAM, and vulnerability scanning through Amazon Inspector. It is indexed under Container Registries.","source":"https://aws.amazon.com/ecr/pricing/","question":"What is Amazon ECR?","confidence":0.6},{"answer":"Amazon ECR offers a free tier, so you can start without paying. Paid plans start at $0.09 per month. Prices are published openly on the vendor's own pricing page. Pricing changes often, so verify at source before relying on it.","source":"https://aws.amazon.com/ecr/pricing/","question":"Is Amazon ECR free?","confidence":0.6},{"answer":"Amazon ECR supports the web and a command-line interface. Platforms we have not confirmed are simply not listed here rather than ruled out.","source":"https://aws.amazon.com/ecr/pricing/","question":"What platforms does Amazon ECR support?","confidence":0.6},{"answer":"We have only confirmed a cloud / SaaS deployment for Amazon ECR, so it appears to be vendor-hosted. If a self-hosted option exists we have not found it documented publicly.","source":"https://aws.amazon.com/ecr/pricing/","question":"Can Amazon ECR be self-hosted?","confidence":0.6},{"answer":"We have confirmed 10 integrations for Amazon ECR, including Amazon ECS, Amazon EKS, Amazon EC2, AWS Lambda, AWS Fargate, AWS App Runner, Amazon Inspector and AWS Marketplace, plus 2 more. This is what we could verify from public sources, so the vendor may support others we have not indexed.","source":"https://aws.amazon.com/ecr/pricing/","question":"What does Amazon ECR integrate with?","confidence":0.6},{"answer":"We have independently confirmed GDPR for Amazon ECR. Certifications we do not list are ones we have not been able to verify from public sources, which is not the same as Amazon ECR not holding them. Always confirm compliance directly before you rely on it.","source":"https://aws.amazon.com/trust-center/?nc1=f_cc","question":"What security certifications does Amazon ECR have?","confidence":0.7}]` | `[{"answer":"Harbor is an open source registry that secures artifacts with policies and role-based access control, ensures images are scanned and free from vulnerabilities, and signs images as trusted. It is indexed under Container Registries.","source":"https://goharbor.io","question":"What is Harbor?","confidence":0.6},{"answer":"Harbor is open source, so it can be self-hosted and used at no licence cost. It is released under the Apache-2.0 licence. Pricing changes often, so verify at source before relying on it.","source":"https://goharbor.io","question":"Is Harbor free to use?","confidence":0.6},{"answer":"Harbor supports the web and a command-line interface. Platforms we have not confirmed are simply not listed here rather than ruled out.","source":"https://goharbor.io","question":"What platforms does Harbor support?","confidence":0.6},{"answer":"Yes. Harbor can be deployed self-hosted, so it does not have to run on the vendor's infrastructure.","source":"https://goharbor.io","question":"Can Harbor be self-hosted?","confidence":0.6},{"answer":"We have confirmed 4 integrations for Harbor, including Trivy, Cosign, Redis and Valkey. This is what we could verify from public sources, so the vendor may support others we have not indexed.","source":"https://goharbor.io","question":"What does Harbor integrate with?","confidence":0.6},{"answer":"Yes. Harbor is published under the Apache-2.0 licence, a permissive licence that generally allows commercial use and modification. Licence terms can change between releases, so verify against the repository for the version you intend to use.","source":"https://github.com/goharbor/harbor","question":"Is Harbor open source?","confidence":0.95}]` |
| deployment.options | `{"cloud":true}` | `{"on_prem":true,"self_hosted":true}` |
| description.long | Amazon ECR is a managed service that stores Docker container images and OCI artifacts with high availability. It integrates with AWS compute services, offers both private and public repositories, and includes built-in encryption, access controls via IAM, and vulnerability scanning through Amazon Inspector. | A self-hosted Docker Distribution extension that provides centralized storage for container images and Helm charts with integrated security features including image signing, vulnerability scanning, user authentication, access control, and cross-registry replication. |
| features.capabilities | `{"rbac":true,"web_ui":true,"hosting":"cloud","image_signing":true,"oci_compliant":true,"private_repos":true,"artifact_types":"images_helm","cloud_iam_native":true,"pull_rate_limits":"tiered","high_availability":true,"pull_through_cache":true,"replication_mirroring":true,"vulnerability_scanning":true}` | `{"rbac":true,"web_ui":true,"hosting":"self","image_signing":true,"oci_compliant":true,"private_repos":true,"artifact_types":"images_helm","high_availability":true,"pull_through_cache":true,"replication_mirroring":true,"vulnerability_scanning":true}` |
| integrations.count | 10 | 6 |
| integrations.list | `[{"name":"Amazon ECS"},{"name":"Amazon EKS"},{"name":"Amazon EC2"},{"name":"AWS Lambda"},{"name":"AWS Fargate"},{"name":"AWS App Runner"},{"name":"Amazon Inspector"},{"name":"AWS Marketplace"},{"name":"Docker CLI"},{"name":"Helm"},{"name":"Docker","native":false,"direction":"bidirectional"}]` | `[{"name":"Trivy"},{"name":"Cosign"},{"name":"Redis"},{"name":"Valkey"},{"name":"LDAP","native":true,"category":"auth","direction":"inbound"},{"name":"Active Directory","native":true,"category":"auth","direction":"inbound"},{"name":"Docker","native":true,"direction":"outbound"},{"name":"Helm","native":true,"direction":"outbound"}]` |
| language.primary | - | Go |
| license.spdx | - | Apache-2.0 |
| market.availability | `{"hqCountry":"US","primaryMarkets":[],"availabilityScope":"global","availableCountries":[],"notAvailableCountries":[]}` | - |
| platform.support | `{"cli":true,"web":true}` | `{"cli":true,"web":true,"linux":true}` |
| pricing | `{"type":"usage","plans":[{"free":false,"name":"Private Repository Storage","summary":"$0.10 per GB per month","features":["Private repository storage"],"components":[{"per":{"qty":1,"unit":"gb"},"kind":"metered","amount":0.1,"period":"month","currency":"USD"}],"description":"Storage for private container repositories","contactSales":false},{"free":true,"name":"Public Repository (Always Free)","summary":"Always free","features":["50 GB/month storage included","500 GB/month anonymous data transfer","5 TB/month data transfer with AWS account"],"description":"Always-free storage and transfer for public repositories","contactSales":false,"includedLimits":{"storage":"50 GB/month","anonymous_transfer":"500 GB/month","authenticated_transfer":"5 TB/month"}},{"free":false,"name":"Data Transfer (Beyond Free Limits)","summary":"Tiered starting at $0.09 per GB","features":["Tiered outbound data transfer pricing"],"components":[{"per":{"qty":1,"unit":"gb"},"kind":"metered","amount":0.09,"period":"month","currency":"USD"}],"description":"Pay for outbound data transfer beyond free tier limits","contactSales":false}],"summary":"Free: 50 GB/month public storage always-free, 500 MB/month private for 1 year. Paid: $0.10/GB for private storage, tiered data transfer charges.","currency":"USD","freeTier":true,"sourceUrl":"https://aws.amazon.com/ecr/pricing/","retrievedAt":"2026-08-14T11:06:02.938Z","startingPrice":{"amount":0.09,"period":"month","currency":"USD"},"billingPeriods":["month"]}` | `{"type":"open_source","freeTier":true,"sourceUrl":"https://goharbor.io","retrievedAt":"2026-10-13T15:18:28.787Z"}` |
| pricing.free_tier | yes | yes |
| pricing.model | commercial | open_source |
| pricing.price_level | unknown | free |
| pricing.transparent | yes | yes |
| release.cadence_days | - | 3 |
| release.history | - | `[{"url":"https://github.com/goharbor/harbor/releases/tag/v2.14.6-rc1","date":"2026-10-13T05:53:24Z","type":"prerelease","version":"v2.14.6-rc1"},{"url":"https://github.com/goharbor/harbor/releases/tag/v2.15.4","date":"2026-10-09T03:28:27Z","type":"stable","version":"v2.15.4"},{"url":"https://github.com/goharbor/harbor/releases/tag/v2.15.4-rc1","date":"2026-10-08T12:46:11Z","type":"prerelease","version":"v2.15.4-rc1"},{"url":"https://github.com/goharbor/harbor/releases/tag/v2.15.3","date":"2026-10-06T13:11:19Z","type":"stable","version":"v2.15.3"},{"url":"https://github.com/goharbor/harbor/releases/tag/v2.14.5","date":"2026-10-06T15:47:31Z","type":"stable","version":"v2.14.5"},{"url":"https://github.com/goharbor/harbor/releases/tag/v2.13.6","date":"2026-10-06T15:48:37Z","type":"stable","version":"v2.13.6"},{"url":"https://github.com/goharbor/harbor/releases/tag/v2.15.3-rc2","date":"2026-09-24T02:31:00Z","type":"prerelease","version":"v2.15.3-rc2"},{"url":"https://github.com/goharbor/harbor/releases/tag/v2.15.3-rc1","date":"2026-09-11T02:50:26Z","type":"prerelease","version":"v2.15.3-rc1"},{"url":"https://github.com/goharbor/harbor/releases/tag/v2.15.2","date":"2026-07-02T10:04:51Z","type":"stable","version":"v2.15.2"},{"url":"https://github.com/goharbor/harbor/releases/tag/v2.15.2-rc3","date":"2026-07-02T03:31:08Z","type":"prerelease","version":"v2.15.2-rc3"},{"url":"https://github.com/goharbor/harbor/releases/tag/v2.15.2-rc2","date":"2026-06-27T08:03:52Z","type":"prerelease","version":"v2.15.2-rc2"},{"url":"https://github.com/goharbor/harbor/releases/tag/v2.15.2-rc1","date":"2026-06-17T07:35:43Z","type":"prerelease","version":"v2.15.2-rc1"},{"url":"https://github.com/goharbor/harbor/releases/tag/v2.14.4","date":"2026-05-11T04:08:08Z","type":"stable","version":"v2.14.4"},{"url":"https://github.com/goharbor/harbor/releases/tag/v2.14.4-rc1","date":"2026-05-10T03:47:44Z","type":"prerelease","version":"v2.14.4-rc1"},{"url":"https://github.com/goharbor/harbor/releases/tag/v2.15.1","date":"2026-05-06T08:48:20Z","type":"stable","version":"v2.15.1"},{"url":"https://github.com/goharbor/harbor/releases/tag/v2.15.1-rc2","date":"2026-05-06T08:24:03Z","type":"prerelease","version":"v2.15.1-rc2"},{"url":"https://github.com/goharbor/harbor/releases/tag/v2.15.1-rc1","date":"2026-04-29T08:21:43Z","type":"prerelease","version":"v2.15.1-rc1"},{"url":"https://github.com/goharbor/harbor/releases/tag/v2.15.0","date":"2026-03-20T04:36:02Z","type":"stable","version":"v2.15.0"},{"url":"https://github.com/goharbor/harbor/releases/tag/v2.15.0-rc4","date":"2026-03-19T08:37:39Z","type":"prerelease","version":"v2.15.0-rc4"},{"url":"https://github.com/goharbor/harbor/releases/tag/v2.15.0-rc3","date":"2026-03-17T06:27:45Z","type":"prerelease","version":"v2.15.0-rc3"}]` |
| reliability.status_page | yes | yes |
| security.certifications | `[{"name":"PCI-DSS","status":"active"},{"name":"HIPAA/HITECH","status":"active"},{"name":"FedRAMP","status":"active"},{"name":"GDPR","status":"active"},{"name":"FIPS 140-3","status":"active"},{"name":"NIST 800-171","status":"active"}]` | - |
| security.disclosure_policy | yes | yes |
| security.fedramp | yes | - |
| security.gdpr | yes | - |
| security.hipaa | yes | - |
| security.pci | yes | - |
| security.scorecard | - | 7.5 |
| security.soc2 | yes | - |
| security.trust_center | https://aws.amazon.com/compliance/ | - |
| security.vulnerabilities | - | `{"count":1,"source":"https://advisories.ecosyste.ms/api/v1/advisories?ecosystem=go&package_name=github.com%2Fgoharbor%2Fharbor%2Fsrc&per_page=100","last_12m":0,"max_severity":"HIGH"}` |

## Capabilities (Container Registries)

| Capability | Amazon ECR | Harbor |
|---|:--:|:--:|
| **Deployment** |  |  |
| Hosting | Cloud only | Self-hosted only |
| **Standards** |  |  |
| OCI Distribution Spec compliant | ✓ | ✓ |
| **Scope** |  |  |
| Artifact types | Images + Helm/OCI artifacts | Images + Helm/OCI artifacts |
| **Security** |  |  |
| Built-in vulnerability scanning | ✓ | ✓ |
| Image signing (Cosign/Notation) | ✓ | ✓ |
| SBOM generation / storage | - | - |
| **Access** |  |  |
| Fine-grained RBAC / robot accounts | ✓ | ✓ |
| Private repositories | ✓ | ✓ |
| **Distribution** |  |  |
| Geo-replication / mirroring | ✓ | ✓ |
| Pull-through cache / proxy | ✓ | ✓ |
| **Integration** |  |  |
| Native cloud IAM integration | ✓ | - |
| **Pricing** |  |  |
| Pull-rate limits | Tiered by plan | - |
| **UX** |  |  |
| Web UI / console | ✓ | ✓ |
| **Ops** |  |  |
| High-availability deployment | ✓ | ✓ |

*Source: vioscaleAI. Generated 2026-10-15T22:57:09.087Z. "-" = undocumented, not absent.*