---
name: Registry-registry_vpe
title: Using VPEs for VPC to privately connect to Container Registry
description: You can use IBM Cloud® virtual private endpoints (VPE) for Virtual Private Cloud (VPC) to connect to IBM Cloud® Container Registry from your VPC network by using the IP addresses of your choice, which are allocated from a subnetwork within your VPC.
last-updated: 2026-05-18
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/Registry?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Using VPEs for VPC to privately connect to Container Registry
{: #registry_vpe}

You can use IBM Cloud® virtual private endpoints (VPE) for Virtual Private Cloud (VPC) to connect to IBM Cloud® Container Registry from your VPC network by using the IP addresses of your choice, which are allocated from a subnetwork within your VPC.
{: shortdesc}

VPEs are virtual IP interfaces that are bound to an endpoint gateway created on a per service, or service instance, basis (depending on the service operation model). The endpoint gateway is a virtualized function that scales horizontally, is redundant and highly available, and spans all [availability zones](#x7018171){: term} of your VPC. Endpoint gateways enable communications from virtual server instances within your VPC and IBM Cloud service on the private backbone. VPE for VPC gives you the experience of controlling all the private addresses within your cloud. For more information, see [About virtual private endpoint gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-about-vpe&format=markdown).

If you're using IBM Cloud Kubernetes Service or Red Hat OpenShift on IBM Cloud, the Container Registry VPE is created for you automatically. For more information, see [Virtual private endpoint (VPE) gateways](https://cloud.ibm.com/docs/containers?topic=containers-vpc-security-group-reference&format=markdown#sbd-managed-vpe-gateways).
{: note}

If you have an IBM Cloud VPC instance and you want to connect the VPC instance to IBM Cloud Container Registry for your Container Registry services, you can create a VPE gateway for your VPC to access IBM Cloud Container Registry within your VPC network. Any connections to IBM Cloud Container Registry that originate from within the VPC automatically go through the Container Registry VPE gateway, if one exists. For more information, see [Getting started with Virtual Private Cloud](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started&format=markdown).

When you connect to Container Registry from the IBM Cloud console, you must go through a browser in your VPC to ensure that the connection goes through the Container Registry VPE gateway.
{: important}

For more information about other IBM Cloud VPE services, see [VPE supported services](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-supported-services&format=markdown).

## Before you begin
{: #registry_vpe_prereqs}

Before you target a VPE for Container Registry, you must complete the following tasks.

- Ensure that a Virtual Private Cloud is created. For more information, see [Getting started with Virtual Private Cloud](https://cloud.ibm.com/docs/vpc?topic=vpc-getting-started&format=markdown).
- Make a plan for your virtual private endpoints. For more information, see [Planning for virtual private endpoint gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-planning-considerations&format=markdown).
- Ensure that the correct access controls are set for your VPE. For more information, see [Configuring ACLs and security groups for use with endpoint gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-configure-acls-sgs-endpoint-gateways&format=markdown).
- Ensure that you understand the limitations of having a VPE. For more information, see [Planning for virtual private endpoint gateways](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-planning-considerations&format=markdown).
- Ensure that you understand how to view details about a VPE. For more information, see [Viewing details of an endpoint gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-viewing-details-of-an-endpoint-gateway&format=markdown).

## Virtual private endpoints
{: #registry_vpe_endpoints}

The table lists IBM Cloud Container Registry private endpoints that are supported from the following VPC regions:

- Chennai - Airtel (`in-che`)
- Dallas (`us-south`)
- Frankfurt (`eu-de`)
- London (`eu-gb`)
- Madrid (`eu-es`)
- Montreal (`ca-mon`)
- Mumbai - Airtel (`in-mum`)
- Osaka (`jp-osa`)
- Sao Paulo (`br-sao`)
- Sydney (`au-syd`)
- Tokyo (`jp-tok`)
- Toronto (`ca-tor`)
- Washington DC (`us-east`)

You can create a VPE gateway for your local Container Registry service only. You can pull images from any other Container Registry region by using the public domains, such as `uk.icr.io`. For more information about mapping the region name to the domain, see [Local regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overview&format=markdown#registry_regions_local).
{: important}

## Setting up a VPE for IBM Cloud Container Registry
{: #registry_vpe_endpoint_setup}

When you create a VPE gateway by using the command-line interface (CLI) or API, you must specify the [cloud resource name (CRN)](#x9494304){: term} of the region that you want to connect to Container Registry. Review the following table for the available regions and CRNs to use to create your VPE gateway.

You can create VPE gateways in these locations:  `au-syd`, `br-sao`, `ca-mon`, `ca-tor`, `eu-de`, `eu-es`, `eu-gb`, `in-che`, `in-mum`, `jp-osa`, `jp-tok`, `us-south`, and `us-east` (global registry).

| Registry region | Region that was formerly known as | Cloud resource name (CRN) |
| --------------- | --------------------------------- | ------------------------- |
| `au-syd` | `ap-south` | `crn:v1:bluemix:public:container-registry:au-syd:::endpoint:au.icr.io` |
| `br-sao` | Not applicable | `crn:v1:bluemix:public:container-registry:br-sao:::endpoint:br.icr.io` |
| `ca-mon` | Not applicable | `crn:v1:bluemix:public:container-registry:ca-mon:::endpoint:ca2.icr.io` |
| `ca-tor` | Not applicable | `crn:v1:bluemix:public:container-registry:ca-tor:::endpoint:ca.icr.io` |
| `eu-de` | `eu-central` | `crn:v1:bluemix:public:container-registry:eu-de:::endpoint:de.icr.io` |
| `eu-es` | Not applicable | `crn:v1:bluemix:public:container-registry:eu-es:::endpoint:es.icr.io` |
| `eu-gb` | `uk-south` | `crn:v1:bluemix:public:container-registry:eu-gb:::endpoint:uk.icr.io` |
| `in-che` | Not applicable | `crn:v1:bluemix:public:container-registry:in-che:::endpoint:in.icr.io` |
| `in-mum` | Not applicable | `crn:v1:bluemix:public:container-registry:in-mum:::endpoint:in2.icr.io` |
| `jp-osa` | Not applicable | `crn:v1:bluemix:public:container-registry:jp-osa:::endpoint:jp2.icr.io` |
| `jp-tok` | `ap-north` | `crn:v1:bluemix:public:container-registry:jp-tok:::endpoint:jp.icr.io` |
| `us-south` | Not applicable | `crn:v1:bluemix:public:container-registry:us-south:::endpoint:us.icr.io` |
| Global `us-east` | Not applicable | `crn:v1:bluemix:public:container-registry:us-east:::endpoint:icr.io` |
{: caption="Region availability and cloud resource names (CRNs) for connecting Container Registry over private IBM Cloud networks" caption-side="bottom"}
{: #table_registry_vpe}

You can pull images from any other Container Registry region by using the public domains, such as `uk.icr.io`. For more information about mapping the region name to the domain, see [Local regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overview&format=markdown#registry_regions_local).

### Configuring an endpoint gateway
{: #registry_endpoint-gateway-servicename}

To configure a VPE gateway, complete the following steps:

1. List the available services, including IBM Cloud infrastructure services available (by default) for all VPC users. For more information, see [VPE supported services](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-supported-services&format=markdown).
2. [Create an endpoint gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-ordering-endpoint-gateway&format=markdown) for IBM Cloud Container Registry that you want to be privately available to the VPC. To create the VPE gateway by using the CLI, run the following command, where `CRN` is the CRN of the target region as shown in the [Region availability and cloud resource names (CRNs) for connecting Container Registry over private IBM Cloud networks](#table_registry_vpe) table, `VPC_ID` is the ID of the VPC, and `MY_NAME` is the name of the new endpoint gateway.

    ```txt
    ibmcloud is endpoint-gateway-create --target CRN --vpc-id VPC_ID --name MY_NAME
    ```
    {: pre}

3. [Bind a reserved IP address](https://cloud.ibm.com/docs/vpc?topic=vpc-bind-unbind-reserved-ip&format=markdown) to the endpoint gateway.
4. View the created VPE gateways associated with the IBM Cloud Container Registry. For more information, see [Viewing details of an endpoint gateway](https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-viewing-details-of-an-endpoint-gateway&format=markdown).

Now your virtual server instances in the VPC can access your IBM Cloud Container Registry instance privately through it.