Docker Content Trust: signing and verifying images

Andrew Dorokhov schedule 1 min read

menu_book Table of Contents

Docker Content Trust (DCT) ensures that only signed images are pulled and run. When DCT is enabled, Docker verifies image signatures before pull.

Enable and disable DCT

export DOCKER_CONTENT_TRUST=1
export DOCKER_CONTENT_TRUST=0

Configure the Docker daemon in /etc/docker/daemon.json:

{
    "content-trust": {
        "mode": "enforced"
    }
}

Generate a key:

docker trust key generate <NAME>

Import a key:

docker trust key load <PEM> --name <NAME>

Manage signers and sign images. See docker trust signer --help and docker trust sign --help.

code

Happy to help — reach out via the contacts or go straight to my Upwork profile.