# Ensure image-based services pull from an approved registry

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876664551597-ensure-image-based-services-pull-from-an-approved-registry
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure services that deploy a prebuilt Docker image pull it from the organization's approved container registry, such as a private registry owned by the company, and not from public registries or untrusted image sources.

**Rationale**

Public images can be changed by their owners at any time, and some contain malware or vulnerable software. Pulling only from an approved registry makes sure every image has been built and checked by your own pipeline before it runs on Render.

**Impact**

-   Only trusted, company-built images are deployed
    
-   Reduces the risk of running malicious or vulnerable images
    
-   Images must be published to the approved registry first
    

**Default Value**

Render can deploy images from any public or private registry that you configure.

**Pre-Requisites**

-   Admin or Developer role on the service
    
-   An approved private registry and its credentials
    

**Remediation**

**Test Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the service to open it.
    
3.  Open the service's Settings page and check the image URL and registry credential used by the service.
    
4.  If the image comes from a registry that is not approved, follow the implementation steps.
    

**Implementation Steps**

1.  Build or copy the image into your approved registry.
    
2.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
3.  From your workspace home (or project), click the service to open it.
    
4.  Add a registry credential for the approved registry in Workspace Settings if it is not already there.
    
5.  Open the service's Settings page, update the image URL to the image in the approved registry, and select the matching registry credential. Alternatively, run: render services update <service> --image <image-url> --registry-credential <credential-name>
    
6.  Save the changes and trigger a deploy.
    

**Backout Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the service to open it.
    
3.  Open the service's Settings page, restore the previous image URL and credential, and deploy.
    

**Reference**

-   [https://render.com/docs/deploying-an-image](https://render.com/docs/deploying-an-image)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.