Iron Bank Registry1
Iron Bank Registry1 is a free Platform One repository for hardened software container images and compliance and vulnerability assessments for the Department …
What Iron Bank Registry1 is
Iron Bank Registry1 is a free Platform One repository for hardened software container images and compliance and vulnerability assessments for the Department of Defense. Registry1 follows the OCI standard and lets account holders download images through the command line; anonymous pulls are not allowed. The Container Hardening Pipeline checks project requirements, builds and scans containers, then publishes findings to VAT and images to Registry1. Image artifacts may include Anchore, Twistlock, and OpenSCAP results, ClamAV scans, Trufflehog secrets checks, Syft software bills of materials, Cosign signatures, and vendor justifications. Images are rebuilt every 24 hours with updated operating-system packages. Iron Bank provides Acceptance Baseline Criteria results and a numeric Overall Risk Assessment score. External images must pass through the pipeline, and Registry1 does not run or automatically deploy published images. Hardened containers do not themselves provide a Certificate to Field or Authority to Operate.
Good
- Free repository for hardened container images
- OCI-compliant command-line registry
- Automated vulnerability and compliance assessments
- Images rebuilt every 24 hours
- Includes SBOM and signature artifacts
Watch out
- Anonymous image pulls are not allowed
- External images must pass the hardening pipeline
- Registry1 does not deploy images
- Hardened containers lack authorization by themselves
Who it suits
Iron Bank suits DoD organizations consuming or contributing containers, authorization officials assessing application risk, and commercial vendors bringing software to the DoD. Users need a Repo1 or Registry1 account for image pulls.
Verdict
Iron Bank Registry1 provides a controlled path for publishing and obtaining assessed container images. Its account requirement, pipeline restriction, and separate authorization limits matter when planning adoption.
Plans and prices
From Iron Bank Registry1's own pricing page, checked 9 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Iron Bank | Free | No cost to contributors or users · Registry1 requires an account for image pulls |
The facts
Each one read from Iron Bank Registry1's own pages, with the date it was checked.
What it does
- Authorization limit
- Hardened containers do not themselves have a Certificate to Field or an Authority to Operate.checked 9 Oct 2026
- Deployment limit
- Iron Bank publishes container images but does not run or automatically deploy them in a user's environment.checked 9 Oct 2026
- Hardening pipeline
- The Container Hardening Pipeline checks project requirements, builds hardened containers, scans them, and publishes findings to VAT and images to Registry1.checked 9 Oct 2026
- Image access
- Registry1 does not allow anonymous image pulls; users need a Repo1/Registry1 account.checked 9 Oct 2026
- Integrations
- The documented ecosystem includes Repo1 Git repositories and CI pipelines, VAT for tracking vulnerability findings and justifications, and tools including Anchore, OpenSCAP, Twistlock, Cosign, and Renovate.checked 9 Oct 2026
- Publishing restriction
- External container images cannot be uploaded directly to the registry; images must pass through the Iron Bank Container Hardening Pipeline.checked 9 Oct 2026
- Purpose
- Iron Bank is a Platform One repository that provides hardened software container images and compliance and vulnerability assessments for the Department of Defense.checked 9 Oct 2026
- Refresh cadence
- Iron Bank images are rebuilt every 24 hours with updated operating system packages.checked 9 Oct 2026
- Registry
- Registry1 is an OCI-compliant registry where users can download images using the command line.checked 9 Oct 2026
- Risk information
- Iron Bank provides automated Acceptance Baseline Criteria compliance results and a numeric Overall Risk Assessment score for images.checked 9 Oct 2026
- Security artifacts
- Hosted containers can include Anchore, Twistlock, and OpenSCAP scan results, ClamAV virus scans, Trufflehog secrets scans, Syft SBOMs, Cosign signatures, and vendor finding justifications.checked 9 Oct 2026
- Support
- Users can request support by creating repository issues with the appropriate templates, attending Iron Bank weekly sessions, or contacting Iron Bank support directly.checked 9 Oct 2026
- Supported users
- Iron Bank is intended for DoD organizations consuming or contributing containers, authorization officials assessing application risks, and commercial vendors bringing applications to the DoD.checked 9 Oct 2026
Alternatives to Iron Bank Registry1
- 1
JFrog Container Registry
Free planWebAPILinuxSelf-hosted7.6Free plan - 2
Inedo ProGet
Free planWebAPILinuxSelf-hosted7.4From $2,395 a year - 3
Alibaba Cloud Container Registry
Free planWebAPILinuxWindows7.1Free plan - 4
Oracle Cloud Infrastructure Container Registry
Free planWebAPILinux7.0Free plan - 5
Samsung Cloud Platform Container Registry
AndroidiOSWebAPI7.0 - 6
Chainguard Registry
Free planWebLinuxSelf-hosted6.8Free plan