---
title: Private registry should use TLS encryption for a secure Docker environment
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Private registry should use TLS
  encryption for a secure Docker environment
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Private registry should use TLS encryption for a secure Docker environment
Classification:complianceFramework:cis-dockerControl:2.5 
## Description{% #description %}

Docker should pull and push images over TLS, with every registry treated as secure.

## Rationale{% #rationale %}

Docker reaches an insecure registry without TLS or without checking its certificate, so anyone on the path can read or replace the images it serves. Docker also stops warning about such registries.

## Audit{% #audit %}

List the insecure registries of the daemon:

```bash
docker info --format '{{ .RegistryConfig.InsecureRegistryCIDRs }} {{ json .RegistryConfig.IndexConfigs }}'
```

Docker always lists `127.0.0.0/8` and `::1/128`. Datadog passes the rule when the daemon lists only these loopback networks as insecure and every registry as secure, and fails it otherwise.

## Remediation{% #remediation %}

Remove `--insecure-registry` from the dockerd command line and `insecure-registries` from `daemon.json`, and give every registry a valid certificate, with its CA under `/etc/docker/certs.d/<registry>/`. Then restart the daemon with `systemctl restart docker`.

## Impact{% #impact %}

None.

## Default value{% #default-value %}

Docker treats every registry as secure, apart from the loopback networks.