compare
Harbor vs Quay
The same facts for both, read from GitHub every night, and the relation a person reviewed.
| Fact | Harbor | Quay |
|---|---|---|
| Language | Go | Python |
| Licence | Apache-2.0 | Apache-2.0 |
| Stars | 30k | 2.8k |
| Latest | v2.15.3 | v3.17.5 |
| Last push | 2026-10-06 | 2026-10-06 |
| Release cadence | about 1 day between releases | about 5 days between releases |
| Active contributors | 32 commit authors on the default branch in the last 90 days | 32 commit authors on the default branch in the last 90 days |
| Flags | none | none |
How they relate
Both replace Docker Hub. Alternatives to Docker Hub →
Full replacementHarborProjects, access control, vulnerability scanning, signing and replication between registries.
Full replacementQuayOrganisations, robot accounts, builds and vulnerability scanning with Clair.
Harbor
- v2.14.52026-10-06[CHERRY-PICK] Make openapi-generator-cli download URL configurable (#23186)
- v2.13.62026-10-06fix: pin redis 7.2.11 instead of 7.2.6 in the redis base image
- v2.15.32026-10-06(high): Path traversal vulnerability in distribution endpoints GHSA-qj39-pjf2-wmrc in a82c5528f
- v2.15.3-rc22026-09-24(cherry-pick) fix: avoid panic in user audit event resolver on nil event data (#23461)pre-release
- v2.15.3-rc12026-09-11(cherry-pick) fix: avoid panic in user audit event resolver on nil event data (#23461)pre-release
Quay
- v3.17.52026-10-05[redhat-3.17] NO-ISSUE: fix(ci): pin s390x buildkit to v0.30.0 to avoid runc masking regression
- v3.16.62026-09-30[redhat-3.16] PROJQUAY-12275: chore(deps): upgrade pyasn1 from 0.6.3 to 0.6.4 to address CVE-2026-59885
- v3.14.92026-09-25[redhat-3.14] NO-ISSUE: fix(ci): use larger runner for build-and-publish multi-arch job
- v3.12.222026-09-11[redhat-3.12] NO-ISSUE: fix(ci): pin s390x buildkit to v0.30.0 to avoid runc masking regression
- v3.9.262026-09-09[redhat-3.9] NO-ISSUE: fix(ci): pin s390x buildkit to v0.30.0 to avoid runc masking regression
Harbor
unsigned The latest release, v2.15.3, carries no signature GitHub could verify.
Loading the security report
Quay
✓ signed The latest release, v3.17.5, carries a signature GitHub verified.
Loading the security report