Freedom251 › Container Registries
Iron Bank Registry1
What Iron Bank Registry1 is
Iron Bank Registry1 is a Platform One repository for hardened container images and compliance and vulnerability assessments for Department of Defense use. Registry1 follows OCI standards and lets account holders download images through the command line; anonymous pulls are not allowed. The Container Hardening Pipeline checks project requirements, builds and scans containers, sends findings to VAT, and publishes images to Registry1. Hosted images can include Anchore, Twistlock, and OpenSCAP results, ClamAV virus scans, Trufflehog secrets scans, Syft software bills of materials, Cosign signatures, and vendor finding justifications. Images are rebuilt every 24 hours with updated operating system packages. Iron Bank also provides automated Acceptance Baseline Criteria results and a numeric Overall Risk Assessment score. External container images cannot be uploaded directly; they must pass through the hardening pipeline. Registry1 publishes images but does not run or automatically deploy them, and hardened containers do not themselves have a Certificate to Field or Authority to Operate. The service is free, but account access is required for image pulls.
Who it suits
It is intended for DoD organizations that consume or contribute containers, authorization officials assessing application risks, and commercial vendors bringing applications to the DoD. It may suit teams that can use the hardening pipeline and manage deployment in their own environment.
What it does well
- Free to contributors and users.
- Images are rebuilt every 24 hours.
- Provides vulnerability findings and risk assessment information.
- Hosted containers can include SBOMs and scan artifacts.
What to know first
- An account is required to pull images.
- External images must pass through the hardening pipeline.
- Registry1 does not run or automatically deploy images.
- Hardened containers lack a Certificate to Field or Authority to Operate.
Limits
Registry1 requires an account for image pulls, and images can be no larger than 20 GB. Contributions cannot bypass the hardening pipeline, and published images are not automatically deployed.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Iron Bank | No cost to contributors or users · Registry1 requires an account for image pulls | Free |
As registry1.dso.mil lists them, read 9 Oct 2026. The maker's own page has the final word.
Getting started
- Open the Registry1 website.
- Create or use a Repo1/Registry1 account.
- Use the command line to download OCI images.
- For contributions, place the project through the Iron Bank Container Hardening Pipeline.
- Review findings and justifications in VAT and available image security artifacts.
- Use Repo1 repositories and CI pipelines with the documented ecosystem tools.
Verdict
Iron Bank provides a free path to hardened container images with associated security artifacts and risk information. Account access, the required hardening pipeline, and separate deployment responsibilities are important constraints to account for.
Questions
How much does Iron Bank Registry1 cost?
The Iron Bank plan is free, with no cost to contributors or users.
Can anyone pull images anonymously?
No. Registry1 requires a Repo1/Registry1 account for image pulls.
What image format does Registry1 use?
Registry1 is an OCI-compliant registry and publishes OCI artifacts.
Can I upload an external image directly?
No. External container images must pass through the Iron Bank Container Hardening Pipeline.
Does Iron Bank deploy containers?
No. Iron Bank publishes container images but does not run or automatically deploy them in a user's environment.
What security evidence can images include?
Hosted containers can include Anchore, Twistlock and OpenSCAP results, ClamAV and Trufflehog scans, Syft SBOMs, Cosign signatures and vendor finding justifications.
Facts from Iron Bank Registry1's own pages
- Authorization limit
- Hardened containers do not themselves have a Certificate to Field or an Authority to Operate. · docs-ironbank.dso.mil, 9 Oct 2026
- Deployment limit
- Iron Bank publishes container images but does not run or automatically deploy them in a user's environment. · docs-ironbank.dso.mil, 9 Oct 2026
- Hardening pipeline
- The Container Hardening Pipeline checks project requirements, builds hardened containers, scans them, and publishes findings to VAT and images to Registry1. · docs-ironbank.dso.mil, 9 Oct 2026
- Image access
- Registry1 does not allow anonymous image pulls; users need a Repo1/Registry1 account. · docs-ironbank.dso.mil, 9 Oct 2026
- Integrations
- The documented ecosystem includes Repo1 Git repositories and CI pipelines, VAT for tracking vulnerability findings and justifications, and tools including Anchore, OpenSCAP, Twistlock, Cosign, and Renovate. · docs-ironbank.dso.mil, 9 Oct 2026
- Publishing restriction
- External container images cannot be uploaded directly to the registry; images must pass through the Iron Bank Container Hardening Pipeline. · docs-ironbank.dso.mil, 9 Oct 2026
- Purpose
- Iron Bank is a Platform One repository that provides hardened software container images and compliance and vulnerability assessments for the Department of Defense. · docs-ironbank.dso.mil, 9 Oct 2026
- Refresh cadence
- Iron Bank images are rebuilt every 24 hours with updated operating system packages. · docs-ironbank.dso.mil, 9 Oct 2026
- Registry
- Registry1 is an OCI-compliant registry where users can download images using the command line. · docs-ironbank.dso.mil, 9 Oct 2026
- Risk information
- Iron Bank provides automated Acceptance Baseline Criteria compliance results and a numeric Overall Risk Assessment score for images. · docs-ironbank.dso.mil, 9 Oct 2026
- Security artifacts
- Hosted containers can include Anchore, Twistlock, and OpenSCAP scan results, ClamAV virus scans, Trufflehog secrets scans, Syft SBOMs, Cosign signatures, and vendor finding justifications. · docs-ironbank.dso.mil, 9 Oct 2026
- Support
- Users can request support by creating repository issues with the appropriate templates, attending Iron Bank weekly sessions, or contacting Iron Bank support directly. · docs-ironbank.dso.mil, 9 Oct 2026
- Supported users
- Iron Bank is intended for DoD organizations consuming or contributing containers, authorization officials assessing application risks, and commercial vendors bringing applications to the DoD. · docs-ironbank.dso.mil, 9 Oct 2026
Where Iron Bank Registry1 stands on Freedom251
- Container Registries#18 of 60