Content trust and image signing in Docker - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Enable Docker Content Trust and pull an image

What is the output when you run the following commands with Docker Content Trust enabled?

export DOCKER_CONTENT_TRUST=1
docker pull alpine:latest

Assume the image is signed and available.

Docker

export DOCKER_CONTENT_TRUST=1
docker pull alpine:latest

A

Pulling trust metadata
Error: trust data expired for alpine:latest

B Error: image verification failed: no trust data for alpine:latest

C

Pulling from library/alpine
Status: Image is unsigned, cannot pull

D

Pulling trust metadata
latest: Pulling from library/alpine
Digest: sha256:... 
Status: Downloaded newer image for alpine:latest

💡 Hint

Docker Content Trust verifies signatures before pulling images.

When DOCKER_CONTENT_TRUST=1 is set, Docker pulls trust metadata and verifies the image signature before downloading. If the image is signed and valid, it proceeds to pull the image.

🧠 Conceptual

intermediate

Purpose of Docker Content Trust

Which of the following best describes the main purpose of Docker Content Trust?

A To verify the integrity and publisher of Docker images using digital signatures

B To automatically update Docker images to the latest version

C To speed up Docker image downloads

D To encrypt Docker images during transfer

💡 Hint

Think about what 'trust' means in software distribution.

Docker Content Trust uses digital signatures to ensure images come from a trusted source and have not been tampered with.

❓ Troubleshoot

advanced

Troubleshooting image pull failure with content trust

You try to pull a signed image with Docker Content Trust enabled but get this error:

Error: remote trust data does not exist for docker.io/library/nginx:latest

What is the most likely cause?

A The image digest has changed but the signature was not updated

B Your Docker client version is too old to support content trust

C The image is unsigned or no trust data was published for this tag

D Your network connection is blocking Docker Hub

💡 Hint

The error mentions 'remote trust data does not exist'.

This error means the image does not have signed trust data published, so Docker cannot verify it with content trust enabled.

🔀 Workflow

advanced

Steps to sign a Docker image using Notary

What is the correct order of steps to sign a Docker image using Docker Content Trust and Notary?

A 3,1,2,4

B 1,2,3,4

C 1,3,2,4

D 3,2,1,4

💡 Hint

You need keys before pushing signed images.

First, you generate or load signing keys, then tag the image, push it with content trust enabled to sign it, and finally verify the signature.

✅ Best Practice

expert

Best practice for managing Docker Content Trust keys

Which practice is the most secure and recommended way to manage Docker Content Trust signing keys in a team environment?

A Share the root signing key file among all team members via email

B Store root keys in a secure hardware security module (HSM) or vault and use delegation keys for daily signing

C Keep all keys on a shared network drive accessible to the team

D Generate new root keys for each image push to avoid key reuse

💡 Hint

Think about limiting exposure of the most sensitive keys.

Root keys are highly sensitive and should be stored securely offline or in an HSM. Delegation keys allow safer daily signing without exposing root keys.