The Images screen lists the images stored on each server, whether they are in use, and how much space they take. Run a container straight from an image, or remove images you no longer need.
Pull an image
Click Pull image, choose a server and a registry (Docker Hub by default), and enter an image such as nginx or myregistry.com/team/app. You can search the registry from the same dialog.
Private registries
Add registries under Images → Registries with their address, username and password. They then appear when pulling images and when pushing images built from Git.
Free up space
Select a single server, then use Prune dangling to remove untagged leftovers, or Prune all unused to remove every image no container uses. The result shows how much space was reclaimed.
Updates and vulnerability scans
Open an image to see its layers, labels and the containers using it. Check for newer image compares it with the registry. Scan now checks the image for known vulnerabilities and lists them by severity; scanning requires the Trivy scanner on the control plane machine.
Approved images policy
Under Images → Policy, administrators can turn on Restrict deployment to approved images. Creating or recreating containers and deploying stacks is then refused unless the image matches an approved pattern.
- nginx — allows every tag of the nginx repository.
- nginx:1.27 — allows exactly that tag.
- nginx:1.* or ghcr.io/acme/* — * matches anything.
Example: allow only your team’s registry images
Add ghcr.io/acme/* as an approved pattern before enabling Restrict deployment to approved images. A stack using ghcr.io/acme/orders-api:release-1 matches that rule; a stack using nginx:alpine needs its own approved pattern. The pattern decides whether an image is permitted; private registry credentials are still needed to pull it.