# Ensure Managed Private Registry Access Is IP-Restricted

- Source: https://support.icompaas.com/support/solutions/articles/a_1791826033916780-ensure-managed-private-registry-access-is-ip-restricted
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [OVH Cloud](https://support.icompaas.com/support/solutions/c_1791819364512367) › [checks](https://support.icompaas.com/support/solutions/folders/f_1791819376721251)
- Last updated: 2026-10-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure each Managed Private Registry has IP restrictions on both its management interface (the Harbor UI and API) and its registry endpoint, so only approved networks can manage the registry or push and pull images.

**Rationale**

Container registries store the images that run in production. If they are reachable from anywhere, attackers can try to log in, steal images that may contain secrets, or push tampered images. IP restrictions limit access to known networks such as CI/CD runners and clusters.

**Impact**

-   Only approved networks can access the registry
    
-   Reduces the risk of image theft or tampering
    
-   New clusters and CI runners must be added to the list
    

**Default Value**

By default, no IP restrictions are set, and the registry is reachable from any IP address.

**Pre-Requisites**

-   Permission to manage the registry
    
-   A list of IP ranges that need access
    

**Test Plan**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  In the left-hand menu, select Managed Private Registry and open the registry.
    
4.  Check the IP restrictions for the management interface and the registry endpoint.
    
5.  Alternatively, use the OVHcloud API console at [https://eu.api.ovh.com/console/](https://eu.api.ovh.com/console/) (or your region's console). Run GET /cloud/project/{serviceName}/containerRegistry/{registryID}/ipRestrictions/management and .../ipRestrictions/registry.
    
6.  If either has no restrictions, follow the implementation steps.
    

**Implementation Steps**

1.  Log in to the OVHcloud Control Panel at [https://www.ovh.com/manager/](https://www.ovh.com/manager/).
    
2.  In the left-hand menu, select Public Cloud and choose your project.
    
3.  Open the registry and add the approved IP ranges to the management and registry IP restrictions.
    
4.  Alternatively, run PUT /cloud/project/{serviceName}/containerRegistry/{registryID}/ipRestrictions/management and .../ipRestrictions/registry with the list of ranges.
    
5.  Confirm that your clusters and CI runners can still pull and push images.
    

**Backout Plan**

1.  Run the same PUT requests with an empty list, or remove the restrictions in the Control Panel.
    

**Reference**

-   [https://docs.ovhcloud.com/en/guides/public-cloud/containers-orchestration/managed-private-registry/add-ip-restrictions](https://docs.ovhcloud.com/en/guides/public-cloud/containers-orchestration/managed-private-registry/add-ip-restrictions)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.