How Does Vultr Enforce Access Control and Image Security at Scale?

1 min readUpdated 26 October 2026

Vultr registry credentials are pull-only by default, push access is opt-in, and images are encrypted at rest.

Vultr Container Registry (VCR) enforces access control through role-based authentication and scoped credentials. By default, generated credentials provide pull-only access, but administrators can enable push access when generating the Docker configuration through the Vultr Console, API, or CLI. This provides fine-grained control over who can upload new images and who can only consume existing ones.

All images stored in VCR are encrypted at rest, ensuring that container images remain secure and accessible only to authorized users and systems.

Note

Public visibility bypasses authentication for a registry. Anyone can view its repositories, and any unauthenticated user can pull its images.

0 Comments

Start the conversation

Be the first to comment and share your perspective with the community.

Vultr Container Registry Credentials Default to Pull Access | Vultr Docs