Description

Ensure services that deploy a prebuilt Docker image pull it from the organization's approved container registry, such as a private registry owned by the company, and not from public registries or untrusted image sources.

Rationale

Public images can be changed by their owners at any time, and some contain malware or vulnerable software. Pulling only from an approved registry makes sure every image has been built and checked by your own pipeline before it runs on Render.

Impact

  • Only trusted, company-built images are deployed

  • Reduces the risk of running malicious or vulnerable images

  • Images must be published to the approved registry first

Default Value

Render can deploy images from any public or private registry that you configure.

Pre-Requisites

  • Admin or Developer role on the service

  • An approved private registry and its credentials

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the service to open it.

  3. Open the service's Settings page and check the image URL and registry credential used by the service.

  4. If the image comes from a registry that is not approved, follow the implementation steps.

Implementation Steps

  1. Build or copy the image into your approved registry.

  2. Sign in to the Render Dashboard at https://dashboard.render.com.

  3. From your workspace home (or project), click the service to open it.

  4. Add a registry credential for the approved registry in Workspace Settings if it is not already there.

  5. Open the service's Settings page, update the image URL to the image in the approved registry, and select the matching registry credential. Alternatively, run: render services update <service> --image <image-url> --registry-credential <credential-name>

  6. Save the changes and trigger a deploy.

Backout Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the service to open it.

  3. Open the service's Settings page, restore the previous image URL and credential, and deploy.

Reference