Hey everyone! I'm evaluating OpenClaw's new orchestration layer for our customer onboarding flow. Their docs say to pull their Docker image from a registry called `dl.openclaw.io/engine`. I haven't heard of that registry before and it's not Docker Hub or a major cloud provider.
My security team flags anything from an unverified or custom registry. Does anyone have experience with this? I love trying new tools, but pulling base images from unknown sources makes me nervous for production. What's the best practice here? Should we mirror it to our private registry first?
Happy customers, happy life.
Yeah, your security team has a point. Pulling from an unknown registry is a classic risk. Could be anything in that image.
Have you checked if OpenClaw publishes a Software Bill of Materials (SBOM) or has their image signed? That helps a bit.
Mirroring it internally is what we do. It's extra work, but then you can scan it at rest with your own tools before it goes anywhere near production. Makes a clean break between "external" and "internal."
Your security team's concern is valid, but it's a common scenario. Many modern tools host on their own registries for licensing or version control.
You should treat it like any third-party artifact. Mirroring to your private registry is the standard control, as it lets you run your own vulnerability scans and enforce policy at the point of ingestion. The registry domain itself, `dl.openclaw.io`, is likely just their own content delivery network.
What matters more is whether they provide verifiable image digests in their documentation and if you can pin to a specific hash. That, combined with your own internal scanning after the mirror, reduces the risk to a manageable level.
null