My CNCF LFX Journey with Harbor Satellite
By Ikram Aloui , LFX Mentee, CNCF Harbor Satellite (2026 Term 1)
Hi, I’m Ikram
I’m a recent master’s graduate in cybersecurity from USTHB University in Algeria. My research focused on cloud-native Zero Trust security, working with Kubernetes, Rancher, Harbor, Istio, and Prometheus , and it’s that work that first pulled me into the open-source world.
After graduating, I joined 8gears as an intern, where I started contributing to the upstream Harbor project. Over the following months I worked on a mix of features, fixes, and security-focused improvements:
- PR #22578 — goharbor/harbor
- [PR #22628 — goharbor/harbor]
- [PR #22896 — goharbor/harbor]
- [PR #23225 — goharbor/harbor]
- [PR #27 — container-registry/harbor-next]
- [PR #161 — container-registry/harbor-next]
That work gave me a strong feel for the Harbor codebase, the maintainer community, and the broader CNCF ecosystem. So when I saw Harbor Satellite listed as a project for the CNCF LFX Mentorship Program (2026 Term 1), I knew immediately it was the one. Edge computing, container security, air-gapped environments, SPIFFE/SPIRE identity , it sat right at the intersection of everything I’d been working on. I applied, got accepted, and three months later, I can say it was one of the most rewarding experiences of my early career.
This is the story of those three months.
What is Harbor Satellite?
Before diving in, here’s the short version of what the project does.
Imagine you’re managing hundreds of retail stores, factories, or remote sites. Each one runs a small Kubernetes cluster and needs to pull container images regularly. Internet at the edge is often slow, unreliable, or non-existent.
Harbor Satellite is a lightweight image cache that sits at the edge, mirrors images from a central Harbor registry, and serves them locally to edge clusters. If the internet goes down, your edge devices keep running. If you have 500 sites, you save 500× the bandwidth.
In short: it’s the missing piece between your central registry and your edge.
My First Weeks
Joining a new open-source project always starts the same way: cloning the repo, setting up your local environment, and trying to get everything running. For me, those first weeks were a real learning curve. I ran into a series of small but stubborn issues , permission errors, port conflicts, configuration quirks , the kind of friction that can quietly discourage a new contributor before they ever write their first line of code.
Instead of just fixing each one and moving on, I decided to document my way through it. Every error message, every workaround, every “aha” moment went into my notes. That eventually turned into my first Medium post, where I walked through the issues I had found and how I solved them , so the next person who tries Harbor Satellite for the first time has a smoother start than I did.
Looking back, those early bumps were actually a gift. They forced me to read the codebase carefully, understand how the pieces fit together, and build a real sense of ownership over the project. By the time I was ready to contribute features and documentation, I already knew the project from the inside.
My Contributions to Harbor Satellite
Once I had a working environment, I started shipping. Here’s what I worked on during the program.
1. Building the Blog Section : PR #360,
Harbor Satellite’s documentation site is built with Hugo. It had docs, but no blog section ,meaning no way to publish architecture guides, deployment tutorials, or release notes in a discoverable, dated format.
I built the entire blog infrastructure: layouts, list pages, post templates, author profiles, tagging, and the navigation entry. The first two posts went live at the same time as the section itself, which meant readers had something to actually read on day one. You can see the result at satellite.container-registry.com/blog.
2.K3s Reference Architecture Guide (PR #352 + blog post)
K3s is one of the most common edge Kubernetes distributions, but there was no end-to-end tutorial showing how to integrate it with Harbor Satellite. I wrote a complete walkthrough covering two deployment methods , Network Mirror and Automated Air-Gap Direct Delivery, including the architecture diagrams, prerequisites, full command sequences, and verification steps.
The PR went through a few rounds of refinement: markdownlint compliance from Codacy, and review comments from CodeRabbit and the maintainers. Each round of feedback made the guide tighter and more accurate.
3. SPIFFE/SPIRE Deployment Guide( blog post):
Harbor Satellite uses SPIFFE/SPIRE for workload identity ,a Zero Trust pattern where services prove their identity cryptographically without long-lived credentials. It’s powerful but not obvious to set up.
I wrote a practical, step-by-step guide that takes a reader from zero to a fully running Satellite with SPIFFE identity validation, including how to test air-gap image pulls to prove the cache is actually working offline. Coming from a Zero Trust research background, this was the post I most enjoyed writing , it lets me combine my academic interest with something concretely useful for the community.
Get ikram aloui’s stories in your inbox
Join Medium for free to get updates from this writer.
4. Architecture Decision Record Reviews ([PR #365], [PR #358])
Beyond shipping code and docs, I participated in design discussions around new ADRs. Reviewing architectural decisions is a different skill from writing code , you have to think about trade-offs, future maintainability, and downstream impact on users. Reading my mentors’ and the maintainers’ reasoning in these threads taught me a lot about how mature open-source projects think long-term.
You can see some of my review comments here: ADR review 1,
5 .Audit Logging for Security Events ( [PR #448 merged]
security events in Harbor Satellite, and it landed in the main branch. The
goal was to give operators a reliable, standards-friendly way to capture
security-relevant events , exactly what you need for compliance an security
monitoring at the edge.
It ships with two pluggable transports that can run independently or together.
Syslog covers file-based logging with configurable rotation (max size, backup count, age retention, and compression), plus network delivery over UDP/TCP to remote SIEM systems and Unix domain socket support for local syslog daemons.
OpenTelemetry lets audit events flow into observability platforms through a configurable OTel endpoint, with its own enable flag so you can opt into either transport.
Beyond the transports, the work wires an audit logger into the startup
sequence, supports hot-reload so audit settings can be reconfigured without restarting the service, and emits events for configuration changes with success/failure outcome tracking. It merged with comprehensive test coverage and an example configuration documenting every parameter.
This one took the program full circle for me: it pulled together the Zero
Trust and security-monitoring themes I’d cared about since my research, and getting it reviewed and merged alongside my mentor Prasanth was the perfect way to close out the mentorship.
My Mentors: Prasanth and Vadim
I was lucky to have @Prasanth Baskar and Vadim Bauer as my mentors. Both were incredibly kind, patient, and supportive throughout the program , always available to answer questions, review my work, and guide me in the right direction. Thank you for everything.
What I Learned
Some lessons in no particular order:
1.Documentation is contribution.Writing a tutorial that saves the next person three hours of debugging is just as valuable as writing a feature.
2. Communication > code.Most of my time wasn’t spent typing , it was spent explaining, asking, listening, and synthesizing. I’ll be honest: sometimes I’m shy to ask, and there were moments when I went ahead and built something on my own, only to realize later that a quick message at the start would have saved me hours. Open source taught me that asking questions early isn’t a weakness it’s a shortcut, and it’s how the community actually works.
3. Open source rewards persistence. Some PRs took multiple review rounds. Each round made the work better.
4.Security has to be observable. Building the audit logging feature taught me that catching security events is only half the job , they also have to reach the people and systems that act on them. Designing it around standard transports like syslog and OpenTelemetry showed me how much thought goes into making a feature fit real-world compliance and SIEM workflows, not just the happy path
What’s Next
The end of the mentorship is not the end of the journey. I plan to:
- Keep contributing to Harbor Satellite and Harbor ecosystem.
- Write more. Technical writing has become something I genuinely enjoy ❤, and there’s plenty more to cover at the intersection of edge computing and security.
To Future LFX Mentees
If you’re thinking about applying:
1. Pick a project you actually care about, not the most popular one. Three months is long enough to burn out on something that doesn’t excite you.
2. Read the codebase before you apply.Even just navigating the repo and reading the README puts you ahead.
3. Document everything.Your own notes become tutorials, blog posts later.
Thank You 💙
Thank you to the CNCF, the Linux Foundation, and the LFX Mentorship program team for making this opportunity possible.
Thank you to Nate Waddington and the mentorship coordination team for keeping the program running smoothly.
Thank you to Prasanth and Vadim for your mentorship, your patience, and your trust.
And thank you to the Harbor and Harbor Satellite community for being welcoming, technically excellent, and a genuinely great group to work with.
This is the beginning, not the end. See you in the PRs.
Connect with me:
- GitHub: [@Aloui-Ikram]
- Medium: [@ikram.aloui]
- linkdIn [@Ikram Aloui]
Project links:
- Harbor Satellite
- CNCF LFX Mentorship Program
