Content trust and image signing in Docker - Commands & Configuration

Introduction

When you download or share Docker images, you want to be sure they are safe and not changed by someone else. Content trust and image signing help you check that images come from the right source and have not been tampered with.

When you want to make sure the Docker image you pull is exactly what the creator published.

When you share Docker images with your team and want to guarantee their authenticity.

When running automated deployments that require verified images to avoid security risks.

When you want to prevent running images that might have been altered by attackers.

When you need to comply with security policies that require image verification.

Commands

This command turns on Docker content trust in your terminal session, so Docker will verify image signatures automatically when pulling or pushing images.

Terminal

export DOCKER_CONTENT_TRUST=1

Expected Output

No output (command runs silently)

Pulls the busybox image from Docker Hub and verifies its signature because content trust is enabled.

Terminal

docker pull busybox:latest

Expected Output

Pull (1 of 1): busybox:latest

Digest: sha256:3a0d9f9a7a7a1e7b2a1f4e3a5f6c7d8e9f0a1b2c3d4e5f67890123456789abcd

Status: Downloaded newer image for busybox:latest

Signs the busybox image locally to create a trusted signature that others can verify before pulling.

Terminal

docker trust sign busybox:latest

Expected Output

Signing and pushing trust metadata for busybox:latest

Finished initializing "busybox" trust repository

Successfully signed busybox:latest

Shows the trust data and signatures for the busybox image to confirm it is signed and trusted.

Terminal

docker trust inspect busybox:latest

Expected Output

{

  "Name": "busybox",

  "SignedTags": {

    "latest": {

      "Digest": "sha256:3a0d9f9a7a7a1e7b2a1f4e3a5f6c7d8e9f0a1b2c3d4e5f67890123456789abcd",

      "Signers": ["your_docker_id"]

    }

  }

}

Key Concept

If you remember nothing else from this pattern, remember: enabling Docker content trust ensures you only use images verified by their creators.

Common Mistakes

Not setting the DOCKER_CONTENT_TRUST environment variable before pulling images.

Docker will not verify image signatures, so you might pull untrusted or tampered images.

Always run 'export DOCKER_CONTENT_TRUST=1' in your terminal before pulling or pushing images to enable verification.

Trying to sign an image without having a Docker Content Trust key set up.

Signing will fail because Docker needs a private key to create the signature.

Initialize your trust keys by running 'docker trust key generate' or follow Docker's key setup process before signing.

Assuming images are trusted without checking signatures using 'docker trust inspect'.

You might run images that are not signed or trusted, risking security.

Use 'docker trust inspect' to verify image signatures before deployment.

Summary

Enable content trust by setting the DOCKER_CONTENT_TRUST environment variable to 1.

Pull images with content trust enabled to verify their signatures automatically.

Sign your own images to create trusted signatures others can verify.

Inspect image trust data to confirm signatures and trust status.