---
name: Registry-registry_security_enforce_portieris
title: Enforcing container image security in Container Registry by using Portieris
description: You can use Portieris to enforce image security policies in IBM Cloud® Container Registry.
last-updated: 2025-10-14
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/Registry?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Enforcing container image security in Container Registry by using Portieris
{: #security_enforce_portieris}

You can use [Portieris](https://github.com/IBM/portieris){: external} to enforce image security policies in IBM Cloud® Container Registry.
{: shortdesc}

Portieris is a Kubernetes admission controller that verifies your container images before you deploy them to your cluster in IBM Cloud Kubernetes Service.

You can use Portieris to enforce policies on image signatures. If an image doesn't meet your policy requirements, the resource that contains the pod is not deployed to your cluster.

Using Portieris to block the deployment of images with issues that are found by Vulnerability Advisor is deprecated.
{: deprecated}

If Portieris is deployed and the cluster workers are showing as working correctly, but nothing is scheduled, see [Why don't my pods restart after my workers are down?](https://cloud.ibm.com/docs/Registry?topic=Registry-troubleshoot-pods&format=markdown) for assistance.
{: tip}

Portieris is supported on Red Hat® OpenShift®.

## Installing Portieris in your cluster
{: #sec_enforce_install_portieris}

To install Portieris in your IBM Cloud Kubernetes Service or Red Hat OpenShift on IBM Cloud cluster, see [Enabling image security enforcement in your cluster](https://cloud.ibm.com/docs/containers?topic=containers-images&format=markdown#portieris-image-sec). If you use this installation, it is deployed and maintained for you and it runs in the control plane, which gives higher availability.

If you prefer to install Portieris directly, or you aren't using IBM Cloud Kubernetes Service or Red Hat OpenShift on IBM Cloud, see [Installing Portieris](https://github.com/IBM/portieris#installing-portieris){: external}.

## Portieris policies
{: #policies_portieris}

Portieris has two types of policy, image policy resources and cluster image policy resources. You can override the default Portieris policies.

For more information about Portieris policies, see [Portieris policies](https://github.com/IBM/portieris/blob/main/POLICIES.md){: external}.

## Uninstalling Portieris
{: #uninstall_portieris}

If you want to uninstall Portieris, see [Uninstall Portieris](https://github.com/IBM/portieris#uninstalling-portieris){: external}.