Harbor can optionally be setting up a daemon on host to listen for rolling-update of a service on UNIX socket - UNIX socket can be forwarded to inside of a docker container that takes webhooks (eg. thin-deployer)

This concept is very secure and clear.