The DoD's source for hardened containers
Access hardened vendor, open-source, and government container images with the security and compliance information needed to evaluate them for your environment.
What is Iron Bank?
Iron Bank is Platform One's repository and hardening ecosystem for container images used across the Department of Defense. It provides hardened vendor, open-source, and government container images along with security and compliance information that programs can use when evaluating software for their environments.
Iron Bank does not authorize a container for your environment. Instead, it provides a secure-by-design baseline and supporting evidence — including vulnerability findings, compliance assessments, Software Bills of Materials (SBOMs), signatures, and risk information — that can support your program's authorization and risk decisions.
💡 Who is this for?
Iron Bank is for anyone who wants to consume or contribute hardened containers, including:
- DoD organizations that want to consume hardened containers and their security evidence
- DoD organizations that want to contribute bug fixes, new applications, or updates
- Authorizing Officials who need information to understand an application's risk profile
- Commercial vendors bringing their applications to the DoD
Pick your path
Pull a hardened container
Browse the catalog, check ABC/ORA compliance, and pull with Docker in minutes.
Consumer Onboarding →Contribute or harden a container
Bring your application through Iron Bank's pipeline and publish it for the DoD.
Contributor Onboarding →Check a container's status
Look up Findings Verified, ABC compliance, and ORA score for any image.
Using the VAT Tool →How Iron Bank works
Iron Bank connects several services to move a container from source through hardening and assessment to a consumable image.
The workflow brings together four core Iron Bank components:
- Repo1 hosts source repositories and CI pipelines used during hardening.
- The Container Hardening Pipeline validates, builds, and scans the image.
- VAT tracks vulnerability findings, justifications, and review information.
- Registry1 stores the hardened images consumers can pull.
What you get with an Iron Bank image
Iron Bank provides more than a container image. Images can include security and software supply chain evidence that helps consumers understand what they are evaluating and deploying.
These artifacts support your program's security and authorization processes; they do not replace your program's own risk assessment.
How containers are evaluated
Iron Bank exposes several indicators that describe different aspects of a container.
| Indicator | What it tells you |
|---|---|
| ABC (Acceptance Baseline Criteria) | Whether the container meets Iron Bank's defined hardening and contribution criteria |
| ORA (Overall Risk Assessment) | A numeric assessment that helps programs evaluate container risk |
| Findings Verified | How much of the container's finding information and submitted justifications has been manually reviewed by the Iron Bank team |
💡 Evaluate the complete picture
ABC, ORA, and Findings Verified describe different aspects of a container. A strong result in one does not guarantee a strong result in another.
Review these indicators together with the container's findings and available security artifacts when evaluating an image for your environment.
⚠️ Understand Iron Bank's scope
- Iron Bank and Repo1 are open to the public. There is no separate locked-down version of Iron Bank.
- Hardened containers do not come with a Certificate to Field (CtF) or Authority to Operate (ATO). Authorization remains your program's responsibility.
- You cannot upload an image directly to the registry. Images must go through the Iron Bank Container Hardening Pipeline.
- Iron Bank does not deploy or run containers. Publishing an image makes it available for consumption; it does not deploy the image into your environment.
- Iron Bank does not provide license-key or intellectual-property protection. Vendors remain responsible for their own licensing and IP requirements.
- Iron Bank is not a fully automated process. Some parts of container hardening and findings review require human involvement.
Your program owns the risk decision
Iron Bank provides hardened images and evidence that can support a program's security assessment, but it does not authorize a container for use in your environment.
Use the container's ABC status, ORA information, Findings Verified status, vulnerability findings, justifications, and available security artifacts to understand its risk profile. Your program and Authorizing Official remain responsible for determining whether that risk is acceptable for your environment.