supply-chain The Honest Ceiling: Why 38 of 94 Images Can Never Route Through Harbor Maximum Harbor routing is 56 of 94 images — the other 38 run only in namespaces that must keep pulling direct, each one a dependency loop with a written reason. The honest framing: routing raises patchability, not visibility.
containers Your Most Secure Images Are the Ones Copacetic Can Never Patch Hardened and distroless bases strip the package manager, which means Copacetic has nothing to run. 96 fixable CVEs, no apk, and the right response is a base bump, not a Copacetic bug report.
supply-chain Why registry.gitlab.com Went First: Eight Images, No Exclusions, the Largest CVE Block Queue order for routing registries through Harbor was chosen by value, not size: gitlabcom carries 8 images, zero excluded namespaces, and roughly 1,195 fixable Critical+High findings — the single largest CVE block in the estate.
containers 105 CVEs to Zero in 40 Seconds: What Copacetic Actually Does to an Image Copacetic patched every fixable OS CVE on our fixtures without a rebuild — and left every application dependency untouched. Both halves of that sentence matter.
platform-engineering The Registry Routing Campaign: Two of Nine, and Why It Goes One at a Time Routing upstream registries through Harbor is three separate jobs per registry — create the cache, enable the rule, move the workloads — and the campaign only works done one registry at a time, safest first.
