> For the complete documentation index, see [llms.txt](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/connectivity/insight-point/insight-point-tenant-registry.md).

# Pulling Insight Point images from your tenant domain

By default, every Insight Point deployment pulls its container image from Veza's public registry: `public.ecr.aws/veza/insight_point:latest`. If pulling from the public registry is not desired or not permitted in your environment, you can pull the image from your Veza **tenant's own registry domain** instead.

Veza serves the Insight Point image from a registry on your tenant domain at `https://<tenant-domain>/v2`. This registry mirrors the public Insight Point image, so the image is identical; only the source changes.

For tightly controlled network environments, this is the recommended approach. Both the install script and the container image come from your tenant domain. You can allowlist a single hostname (`*.vezacloud.com`) plus the Veza NAT Gateway IP addresses, rather than the public registry's rotating IP addresses.

## When to use it

Pull from your tenant domain when:

* Your environment does not allow outbound access to `public.ecr.aws`.
* You operate in a restricted or air-gapped network and prefer to pull over a domain you already trust for Insight Point connectivity.
* Your security policy requires container images to come from an approved internal or vendor-hosted registry rather than a public one.

## Prerequisite: verify you can pull from your tenant domain

Before applying an image override, confirm that the image can actually be pulled from your tenant domain (see [Verify the pull](#verify-the-pull) below).

* If the pull **succeeds**, the registry is available for your tenant, so proceed with the override for your deployment method.
* If the pull **fails**, **contact Veza support** to have the registry enabled for your tenant.

{% hint style="warning" %}
Do not apply the image override until the pull succeeds. If the Insight Point is deployed with an override it cannot resolve, it will fail to start.
{% endhint %}

Veza enables the tenant registry on a per-tenant basis; it is not self-service.

To reach the tenant-domain registry through a tightly controlled firewall, allow outbound HTTPS (443) to your tenant domain (`*.vezacloud.com`) and the Veza NAT Gateway IP addresses. For the domains and per-region IP addresses to allowlist, see [Prerequisites and Connectivity](/4yItIzMvkpAvMVFAamTf/integrations/connectivity.md#firewall-rules-and-filters).

## Image reference

Use a fully qualified image reference built from your tenant domain:

```
<tenant-domain>/veza/insight_point:latest
```

For example: `acme.vezacloud.com/veza/insight_point:latest`.

Notes:

* Do **not** include `/v2` in the image reference. `/v2` is the standard OCI registry API path that container clients (Docker, containerd) add automatically.
* Use the `latest` tag to track the current build. Date-build tags (`YYYY.M.D-N`) are also available and are immutable.
* The registry serves just the Insight Point image. It is read-only (pull only).

## Verify the pull

Run one of the following from a host that can reach your tenant domain:

```bash
# Registry API reachability (expect HTTP 200)
curl -sf -o /dev/null -w '%{http_code}\n' https://<tenant-domain>/v2/

# Or pull the image directly
docker pull <tenant-domain>/veza/insight_point:latest
```

If neither succeeds, contact Veza support before continuing.

## Configure per deployment method

Once the pull is verified, point your deployment at the tenant-domain image reference.

### Install script (Docker) and AWS EC2

EC2 deployments use the install script, so both follow the same steps.

Set `IMAGE_REPOSITORY` (and optionally `IMAGE_TAG`) in `/etc/veza-insight-point/service.env`:

```shell
IMAGE_REPOSITORY="<tenant-domain>/veza/insight_point"
```

Then restart the service. See [Deploying an Insight Point using the install script](/4yItIzMvkpAvMVFAamTf/integrations/connectivity/insight-point/insight-point-install-script.md#pull-from-a-different-registry) and [Deploy with AWS EC2](/4yItIzMvkpAvMVFAamTf/integrations/connectivity/insight-point/insight-point-ec2.md).

### Helm / Kubernetes

Set the `image` value to the tenant-domain reference:

```bash
--set image=<tenant-domain>/veza/insight_point:latest
```

See [Insight Point (Helm Chart)](/4yItIzMvkpAvMVFAamTf/integrations/connectivity/insight-point/insight-point-kubernetes.md).

### Virtual Appliance (OVA)

Set the **Insight Point Image Override** property (or `INSIGHT_POINT_IMAGE` for manual hypervisors) to the tenant-domain reference. See the [Image Override](/4yItIzMvkpAvMVFAamTf/integrations/connectivity/insight-point/ova-v2.md#image-override) section of the Virtual Appliance guide for the full procedure.

### Azure Container Instances

When configuring the container, select **Other registry** and set the image path to `<tenant-domain>/veza/insight_point:latest`. See [Deploy with Azure Container Instances](/4yItIzMvkpAvMVFAamTf/integrations/connectivity/insight-point/azure.md).

## Keeping the image current

The Insight Point re-pulls the image on restart (the install-script and OVA services pull on every restart; Kubernetes pods use `imagePullPolicy: Always`), so a restart picks up the latest image from your tenant domain. The data-plane binary auto-upgrades independently of the container image.

## Limitations

* The registry is read-only: you can pull but not push or delete images.
* Only the Insight Point image (`veza/insight_point`) is served.
* The `latest` tag tracks the current build and changes over time; date-build tags (`YYYY.M.D-N`) are immutable.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/connectivity/insight-point/insight-point-tenant-registry.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.