Use the vSphere Docker Credential Helper CLI to securely push container images to and pull container images from the embedded Harbor Registry.

The Kubernetes CLI Tools download page includes a link to download the vSphere Docker Credential Helper. Use the vSphere Docker Credential Helper to securely connect your Docker client to the embedded Harbor Registry.



  1. Using a browser, navigate to the Kubernetes CLI Tools download URL for your environment.
  2. Scroll down to the vSphere Docker Credential Helper section.
  3. Select the operating system.
  4. Download the file.
  5. Extract the contents of the ZIP file to a working directory.
    The docker-credential-vsphere binary executable is available.
  6. Copy the docker-credential-vsphere binary to your Docker client host.
  7. Add the location of the binary to your system PATH.
    For example, on Linux:
    mv docker-credential-vsphere /usr/local/bin/docker-credential-vsphere
  8. Verify the installation of the vSphere Docker Credential Helper by running the command docker-credential-vsphere in a shell or terminal session.
    You see the banner message, and the list of command-line options for the CLI.
    vSphere login manager is responsible for vSphere authentication. 
    It allows vSphere users to securely login and logout to access Harbor images.
      docker-credential-vsphere [command]
    Available Commands:
      help        Help about any command
      login       Login into specific harbor server and get authentication
      logout      Logout from Harbor server and erase user token
      -h, --help   help for docker-credential-vsphere
    Use "docker-credential-vsphere [command] --help" for more information about a command.
  9. Log in to the embedded Harbor Registry.
    First, check the usage:
    docker-credential-vsphere login -help
      docker-credential-vsphere login [harbor-registry] [flags]
      -h, --help               help for login
      -s, --service string     credential store service
          --tlscacert string   location to CA certificate (default "/etc/docker/certs.d/*.crt")
      -u, --user string        vSphere username and password
    Then, log in using the following command:
    docker-credential-vsphere login <container-registry-IP>
    The authentication token is fetched and saved, and you are logged in.
    docker-credential-vsphere login
    Username: administrator@vsphere.local
    Password: INFO[0017] Fetched username and password
    INFO[0017] Fetched auth token
    INFO[0017] Saved auth token
  10. Log out of the embedded Harbor Registry.
    docker-credential-vsphere logout

What to do next

Push Images to the Embedded Harbor Registry.