# Image registry restrictions policy

> [HTML Version](kyverno-restrict-images.html)

You can prevent containers from running images from unauthorized Docker image registries in selected Kubernetes namespaces.

For example, you can allow images to be pulled only from your company registry **registry.company.com**. This reduces the risk of running images from untrusted sources.

## Configuring the file

To check the source of Docker images, configure the `estrictImageRegistries` block in the ** values-policies.yaml**:

````
...  
\## This policy allows containers to run only images from trusted registries  
restrictImageRegistries:  
  enabled: true  
\## Namespaces where the image registry restrictions policy will apply  
  namespace:  
    - brix365  
\## Allowed Docker image registries  
  allowedRegistries:  
    - registry.company.com  
...

````
Where:

- `restrictImageRegistries.enabled` : set the value `true` to enable registry checks. Set `false` to disable registry checks.

- `restrictImageRegistries.namespace`: specify the namespaces where the policy will apply.

- `restrictImageRegistries.allowedRegistries`: specify the allowed image registries.

After configuring the security policy, install the **kyverno-policies** chart as described in step 3 of stage 2 in [Install Kyverno](install-kyverno.md#install-kyverno-policies).