Can you block community images on Docker Hub for your team?

Yes, if your organisation uses Docker's Image Access Management. Admins can allow or block categories of Docker Hub images: organisation images, Docker Official Images, Verified Publisher images and community images, plus an allowlist of specific repositories. It applies only to Docker Hub and has bypass routes you should know about.

What the control does

According to Docker's documentation, Image Access Management lets administrators decide which Docker Hub image types developers can pull. The categories are:

• Organisation images, allowed by default.
• Docker Official Images.
• Docker Verified Publisher images.
• Community images, public images from individual developers, which are off by default. Docker-Sponsored Open Source images fall into this category.
• A repository allowlist, for specific approved repositories that every member can reach regardless of the other settings.

It affects FROM instructions, Compose services and multi-stage builds, and the documentation notes it can affect CI pipelines that use a restricted image type.

What it needs

• Developers must be signed in to Docker Desktop with organisation credentials, because the policy applies to signed-in users. Enforcing sign-in matters, otherwise signing out avoids the policy.
• Authentication uses personal access tokens. Organisation access tokens are not supported for this feature.
• A Docker Business subscription is part of the requirements.

Gaps to plan for

The documentation lists the limits plainly. It applies only to Docker Hub, so other registries need a different control. Users may bypass it by signing out if sign-in is not enforced, by pulling from unrestricted registries, or by using mirrors or proxies. Organisation owners always have access to all images.

That means the policy is a guard rail for the ordinary developer path, not a wall. A person using a machine outside the managed setup, or a CI runner that is not signed in, is not covered.

Pair it with checks you control

1. Decide which categories your teams may use and write the reason down, so an exception request has something to be compared with.
2. Use the repository allowlist for the few community images you have reviewed and want to keep.
3. Add a check in code review or CI that flags image references outside the approved list. That works for any registry and for runners that never sign in to Docker Desktop.
4. Scan every approved image anyway. Category approval says who published it, not what is inside.
5. Review the allowlist on a schedule, and drop entries nobody uses.

What to expect from developers

Blocking community images by default will produce requests. Make the exception path quick: a short form, a named reviewer, and a same-week answer. A slow path teaches people to work around the control.

Quick check

Safeguard policies and gates can enforce what your pull requests and pipelines are allowed to ship, and dependency scanning plus SBOM cover each approved image. Start with a free scan at gold.safeguard.sh/scan.

Sources

• Docker Docs: Image Access Management

Last reviewed: 19 October 2026.