Iron Bank Registry1

Spec sheet

Purpose

Iron Bank is a Platform One repository that provides hardened software container images and compliance and vulnerability assessments for the Department of Defense.Read 9 Oct 2026 · docs-ironbank.dso.mil

Integrations

The documented ecosystem includes Repo1 Git repositories and CI pipelines, VAT for tracking vulnerability findings and justifications, and tools including Anchore, OpenSCAP, Twistlock, Cosign, and Renovate.Read 9 Oct 2026 · docs-ironbank.dso.mil

Support

Users can request support by creating repository issues with the appropriate templates, attending Iron Bank weekly sessions, or contacting Iron Bank support directly.Read 9 Oct 2026 · docs-ironbank.dso.mil

Authorization limit

Hardened containers do not themselves have a Certificate to Field or an Authority to Operate.Read 9 Oct 2026 · docs-ironbank.dso.mil

Deployment limit

Iron Bank publishes container images but does not run or automatically deploy them in a user's environment.Read 9 Oct 2026 · docs-ironbank.dso.mil

Hardening pipeline

The Container Hardening Pipeline checks project requirements, builds hardened containers, scans them, and publishes findings to VAT and images to Registry1.Read 9 Oct 2026 · docs-ironbank.dso.mil

Image access

Registry1 does not allow anonymous image pulls; users need a Repo1/Registry1 account.Read 9 Oct 2026 · docs-ironbank.dso.mil

Publishing restriction

External container images cannot be uploaded directly to the registry; images must pass through the Iron Bank Container Hardening Pipeline.Read 9 Oct 2026 · docs-ironbank.dso.mil

Refresh cadence

Iron Bank images are rebuilt every 24 hours with updated operating system packages.Read 9 Oct 2026 · docs-ironbank.dso.mil

Registry

Registry1 is an OCI-compliant registry where users can download images using the command line.Read 9 Oct 2026 · docs-ironbank.dso.mil

Risk information

Iron Bank provides automated Acceptance Baseline Criteria compliance results and a numeric Overall Risk Assessment score for images.Read 9 Oct 2026 · docs-ironbank.dso.mil

Security artifacts

Hosted containers can include Anchore, Twistlock, and OpenSCAP scan results, ClamAV virus scans, Trufflehog secrets scans, Syft SBOMs, Cosign signatures, and vendor finding justifications.Read 9 Oct 2026 · docs-ironbank.dso.mil

Supported users

Iron Bank is intended for DoD organizations consuming or contributing containers, authorization officials assessing application risks, and commercial vendors bringing applications to the DoD.Read 9 Oct 2026 · docs-ironbank.dso.mil

Plans and prices

Every Iron Bank Registry1 plan and price →

Where Specifiction places it

• Container Registries#28 of 607.5