Harbor

Harbor is a CNCF-graduated container registry: private image storage with role-based access control, vulnerability scanning, image signing and replication between registries.

It is built for organizations, and the footprint reflects that — Harbor is a multi-service deployment, not a single container. For a personal registry it is overkill; for a team shipping images to production, the scanning and RBAC quickly justify the weight.

Deploy it when "docker push to somewhere we control" becomes a compliance question rather than a convenience.