Content trust and image signing in Docker - Commands & Configuration

Introduction

When you download or share Docker images, you want to be sure they are safe and not changed by someone else. Content trust and image signing help you check that images come from the right source and have not been tampered with.

When you want to make sure the Docker image you pull is exactly what the creator published.

When you share Docker images with your team and want to guarantee their authenticity.

When running automated deployments that require verified images to avoid security risks.

When you want to prevent running images that might have been altered by attackers.

When you need to comply with security policies that require image verification.

Commands

This command turns on Docker content trust in your terminal session, so Docker will verify image signatures automatically when pulling or pushing images.

Terminal

export DOCKER_CONTENT_TRUST=1

Expected Output

No output (command runs silently)

Pulls the busybox image from Docker Hub and verifies its signature because content trust is enabled.

Terminal

docker pull busybox:latest

Expected Output

Pull (1 of 1): busybox:latest

Digest: sha256:3a0d9f9a7a7a1e7b2a1f4e3a5f6c7d8e9f0a1b2c3d4e5f67890123456789abcd

Status: Downloaded newer image for busybox:latest

Signs the busybox image locally to create a trusted signature that others can verify before pulling.

Terminal

docker trust sign busybox:latest

Expected Output

Signing and pushing trust metadata for busybox:latest

Finished initializing "busybox" trust repository

Successfully signed busybox:latest

Shows the trust data and signatures for the busybox image to confirm it is signed and trusted.

Terminal

docker trust inspect busybox:latest

Expected Output

{

  "Name": "busybox",

  "SignedTags": {

    "latest": {

      "Digest": "sha256:3a0d9f9a7a7a1e7b2a1f4e3a5f6c7d8e9f0a1b2c3d4e5f67890123456789abcd",

      "Signers": ["your_docker_id"]

    }

  }

}

Key Concept

If you remember nothing else from this pattern, remember: enabling Docker content trust ensures you only use images verified by their creators.

Common Mistakes

Not setting the DOCKER_CONTENT_TRUST environment variable before pulling images.

Docker will not verify image signatures, so you might pull untrusted or tampered images.

Always run 'export DOCKER_CONTENT_TRUST=1' in your terminal before pulling or pushing images to enable verification.

Trying to sign an image without having a Docker Content Trust key set up.

Signing will fail because Docker needs a private key to create the signature.

Initialize your trust keys by running 'docker trust key generate' or follow Docker's key setup process before signing.

Assuming images are trusted without checking signatures using 'docker trust inspect'.

You might run images that are not signed or trusted, risking security.

Use 'docker trust inspect' to verify image signatures before deployment.

Summary

Enable content trust by setting the DOCKER_CONTENT_TRUST environment variable to 1.

Pull images with content trust enabled to verify their signatures automatically.

Sign your own images to create trusted signatures others can verify.

Inspect image trust data to confirm signatures and trust status.

Practice

1. What is the main purpose of Docker content trust?

easy

A. To speed up Docker image downloads

B. To verify the authenticity and integrity of Docker images

C. To compress Docker images for storage

D. To automatically update Docker images

Solution

1. Step 1: Understand content trust concept

   Content trust in Docker is designed to ensure images are verified and safe to use by checking their signatures.

2. Step 2: Identify the purpose from options

   Only To verify the authenticity and integrity of Docker images mentions verifying authenticity and integrity, which matches content trust's goal.

3. Final Answer:

   To verify the authenticity and integrity of Docker images -> Option B

4. Quick Check:

   Content trust = verify image authenticity [OK]

Hint: Content trust means verifying image signatures before use [OK]

Common Mistakes:

• Confusing content trust with image compression
• Thinking content trust speeds up downloads
• Assuming content trust auto-updates images

2. Which command correctly enables Docker content trust before pulling an image?

easy

A. set DOCKER_CONTENT_TRUST=1 docker pull alpine

B. docker pull --trust alpine

C. export DOCKER_CONTENT_TRUST=1 && docker pull alpine

D. docker pull alpine --enable-content-trust

Solution

1. Step 1: Recall how to enable content trust

   Content trust is enabled by setting the environment variable DOCKER_CONTENT_TRUST=1 before running docker pull.

2. Step 2: Match correct syntax

   export DOCKER_CONTENT_TRUST=1 && docker pull alpine uses the correct shell syntax to export the variable and then pull the image.

3. Final Answer:

   export DOCKER_CONTENT_TRUST=1 && docker pull alpine -> Option C

4. Quick Check:

   Set env var DOCKER_CONTENT_TRUST=1 before pull [OK]

Hint: Use export DOCKER_CONTENT_TRUST=1 before docker pull [OK]

Common Mistakes:

• Using incorrect flags like --trust or --enable-content-trust
• Trying to set env var inline without export
• Confusing Windows and Linux environment variable syntax

3. What will happen if you run docker pull alpine with DOCKER_CONTENT_TRUST=1 set but the image is unsigned?

medium

A. The image will be pulled without verification

B. Docker will automatically sign the image locally

C. Docker will pull the image but warn about missing signature

D. Docker will refuse to pull the image and show an error

Solution

1. Step 1: Understand content trust behavior on unsigned images

   When content trust is enabled, Docker requires a valid signature to pull an image.

2. Step 2: Identify expected Docker response

   If the image is unsigned, Docker refuses to pull it and shows an error to prevent unverified usage.

3. Final Answer:

   Docker will refuse to pull the image and show an error -> Option D

4. Quick Check:

   Content trust blocks unsigned image pulls [OK]

Hint: Content trust blocks unsigned images from pulling [OK]

Common Mistakes:

• Thinking Docker pulls unsigned images anyway
• Assuming Docker signs images automatically
• Believing Docker only warns but allows pull

4. You enabled content trust but get an error: no trust data available when pulling an image. What is the likely cause?

medium

A. The image has no signed tags in the registry

B. Docker daemon is not running

C. You forgot to set DOCKER_CONTENT_TRUST=0

D. Your internet connection is down

Solution

1. Step 1: Analyze the error message meaning

   'No trust data available' means Docker cannot find signed metadata for the image tags in the registry.

2. Step 2: Match cause to options

   The image has no signed tags in the registry correctly states the image lacks signed tags, causing this error when content trust is enabled.

3. Final Answer:

   The image has no signed tags in the registry -> Option A

4. Quick Check:

   No trust data = no signed tags in registry [OK]

Hint: No trust data means image tags are unsigned [OK]

Common Mistakes:

• Assuming Docker daemon stopped causes this error
• Thinking DOCKER_CONTENT_TRUST=0 fixes error when trust is needed
• Blaming internet connection without checking image signing

5. You want to ensure only signed images are deployed in your production environment. Which approach best achieves this?

hard

A. Set DOCKER_CONTENT_TRUST=1 on all production servers and pull images normally

B. Manually verify image signatures after pulling unsigned images

C. Disable content trust and rely on image tags naming conventions

D. Use docker pull --no-trust to skip signature checks

Solution

1. Step 1: Identify how to enforce signed image usage

   Setting DOCKER_CONTENT_TRUST=1 forces Docker to only pull images with valid signatures, blocking unsigned ones.

2. Step 2: Evaluate options for production safety

   Set DOCKER_CONTENT_TRUST=1 on all production servers and pull images normally correctly enforces signature verification automatically on production servers.

3. Final Answer:

   Set DOCKER_CONTENT_TRUST=1 on all production servers and pull images normally -> Option A

4. Quick Check:

   Enable content trust to enforce signed images [OK]

Hint: Enable DOCKER_CONTENT_TRUST=1 in production for safety [OK]

Common Mistakes:

• Trying to verify signatures manually after pull
• Disabling content trust and trusting tags only
• Using flags to skip trust checks in production