Citrix SecurSpaces™

Registry access

August 19, 2026

Contributed by:

Two separate settings control how Citrix SecurSpaces™ deals with container registries: one restricts where workspace images may come from, the other sets where images built on the platform are stored.

Both are platform-level and require the Security permission set to Manage. See Roles and permissions.

Image URL constraints

By default, a project owner can import a workspace image from any registry they can reach. Registry Access Management replaces that with an allowlist: when the feature is enabled, SecurSpaces blocks every registry except those you list.

This matters because a workspace image is arbitrary code that runs with access to your source. Restricting the registries is how you stop an image arriving from somewhere nobody has reviewed.

registry-access-light-cropped

To restrict registries:

Open System Configuration and select Registry Access.
Enable the feature.
Select Add Registry and enter the registry.
Set each entry to Allowed or Denied.

An entry can be switched between allowed and denied without removing it, so you can withdraw a registry temporarily without losing the list.

Note:

Turning the feature on affects imports made from that point. Review the images already registered on the platform as well, since an image imported before the constraint was applied continues to be available. See Container images.

Create image registry

Create Image Registry specifies the Docker container registry used to store images created on the platform. It is the destination for images SecurSpaces builds, not a source of images to import.

create-image-registry

Provide the registry endpoint and the credentials SecurSpaces should use to push to it. Any OCI-compatible registry works — for example Amazon ECR, Azure Container Registry, Google Artifact Registry, or JFrog Artifactory.

Configuring this registry also switches on Create Image From Existing, which lets project members build a derived image from an existing one by supplying a bash script. Until a destination registry is set, that option does not appear. See Create an image from an existing one.

If you also use registry access constraints, make sure this destination registry appears in the allowlist. Otherwise the platform can push an image that workspaces are then blocked from pulling.

The official version of this product documentation is in English. Any non-English version is solely provided for your convenience and may include machine-translated content. For more information, please refer to the Machine Translation Disclaimer on Cloud Software Group home.

Was this helpful

Registry access

August 19, 2026

Contributed by:

August 19, 2026

Contributed by:

Registry access

Image URL constraints

Create image registry

Related information

In this article