Container Registry and Software Supply Chain Platform · View 05 of 33 · 2 · Structure
Sizing rationale
- 8 harbor-registry replicas sized for 25,000 pulls/hour steady, with the regional cache absorbing the 250,000/hour burst
- 8 indexer workers to keep 90 MB/day of new SBOM and attestation data within the 10-minute push-to-verdict budget
- 3 admission-webhook replicas per cluster for 400 reviews/s sustained and 2,000/s for 60 s
Assumptions
- ClickHouse at 6 shards × 2 replicas keeps the component query inside p95 ≤ 3 s at 40,000 artifacts × 1,800 components
- Kafka retains the evidence topic for 7 days, long enough to rebuild an edge cache without touching the origin
- PostgreSQL under Patroni, one write region per repository — no global synchronous write anywhere
Risks
- The platform operates seven stateful systems on premises; this is the largest single operational cost of choosing open source over managed services
- ClickHouse and Kafka both need a named owner or the rebuild budget of 4 hours is fiction
