pullistFirewall openings needed to pull container images.

Red Hat (registry.redhat.io)

Red Hat container registries, used by RHEL, OpenShift operators and all Red Hat products. Blobs redirect to the Quay CDN.

HostPortsPurpose
registry.redhat.io443Authenticated registry (manifests, auth, blob requests)required
registry.access.redhat.com443Unauthenticated legacy registry (UBI and older paths)required
registry.connect.redhat.com443Partner / certified third-party imagesoptional
sso.redhat.com443Authentication for registry.redhat.iorequired
cdn.quay.io80 443Blob CDN (redirect target)required
cdn01.quay.io80 443Blob CDN (redirect target)required
cdn02.quay.io80 443Blob CDN (redirect target)required
cdn03.quay.io80 443Blob CDN (redirect target)required
cdn04.quay.io80 443Blob CDN (redirect target, added 2025)required
cdn05.quay.io80 443Blob CDN (redirect target, added 2025)required
cdn06.quay.io80 443Blob CDN (redirect target, added 2025)required

Notes

The Red Hat registries answer blob requests with an HTTP 302 redirect to a short-lived signed URL on the Quay CDN hosts. If cdn01-06.quay.io are not open, manifest pulls succeed but image config / layer downloads fail with "connection refused" or i/o timeout (ImagePullBackOff in OpenShift). Red Hat recommends hostname-based rules, not IP-based - the IPs are not static. cdn04-06.quay.io were added in 2025 and are a common gap in allowlists created before that.

Copy-paste

Plain domain list: redhat.txt · JSON: redhat.json · connectivity test: check-redhat.sh

registry.redhat.io
registry.access.redhat.com
registry.connect.redhat.com
sso.redhat.com
cdn.quay.io
cdn01.quay.io
cdn02.quay.io
cdn03.quay.io
cdn04.quay.io
cdn05.quay.io
cdn06.quay.io

Verify from inside the network

curl -fsSL https://pullist.d0t.se/check-redhat.sh | sh

Sources

Last verified: 2026-06-12 · data file: data/redhat.yaml