Content trust and image signing in Docker - Step-by-Step Execution

Process Flow - Content trust and image signing

Build Docker Image

↓

Sign Image with Notary

↓

Push Signed Image to Registry

↓

Enable Content Trust on Client

↓

Pull Image

↓

Verify Signature

Yes No↓

Run Image

This flow shows how a Docker image is built, signed, pushed, and then verified on pull before running.

Execution Sample

Docker

export DOCKER_CONTENT_TRUST=1

docker build -t myapp:1.0 .
docker push myapp:1.0
docker pull myapp:1.0

This sequence builds an image, pushes it with a signature, then pulls and verifies the signature before use.

Process Table

Step	Command	Action	Result	Notes
1	docker build -t myapp:1.0 .	Build image locally	Image 'myapp:1.0' created	Image ready for signing
2	docker push myapp:1.0	Push image and sign	Image and signature uploaded	Signature stored in Notary server
3	export DOCKER_CONTENT_TRUST=1	Enable content trust	Client will verify signatures	Prevents unsigned image pull
4	docker pull myapp:1.0	Pull image with verification	Image pulled and signature verified	Image trusted and safe to run
5	docker pull unsignedimage:latest	Pull unsigned image with trust enabled	Pull fails with error	Prevents running untrusted images

💡 Content trust enabled, unsigned images are rejected on pull

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5
DOCKER_CONTENT_TRUST	0 (disabled)	0	0	1 (enabled)	1	1
Image 'myapp:1.0'	none	built	pushed & signed	pushed & signed	pulled & verified	pulled & verified
Image 'unsignedimage:latest'	none	none	none	none	none	pull failed

Key Moments - 3 Insights

Why does the pull fail when content trust is enabled for an unsigned image?

Because with content trust enabled (see step 3 and 5 in execution_table), Docker requires a valid signature. Without it, the pull is rejected to keep the system safe.

What happens if you push an image without signing it?

The push will succeed but without a signature. Later, if content trust is enabled, pulling that image will fail (see step 5). Signing happens during push if trust is enabled.

Does enabling content trust affect building images?

No, building images is unaffected (step 1). Content trust only affects pushing and pulling images by requiring signatures.

Visual Quiz - 3 Questions

Look at the execution_table, what is the state of DOCKER_CONTENT_TRUST after step 3?

A Enabled (1)

B Unset

C Disabled (0)

D Partially enabled

💡 Hint

Check variable_tracker column 'After Step 3' for DOCKER_CONTENT_TRUST

At which step does the image get signed?

A Step 1 - build

B Step 2 - push

C Step 3 - enable trust

D Step 4 - pull

💡 Hint

Look at execution_table 'Action' and 'Result' columns for step 2

If DOCKER_CONTENT_TRUST was not enabled, what would happen at step 5 when pulling an unsigned image?

A Image gets signed automatically

B Pull fails with error

C Pull succeeds without verification

D Docker blocks all pulls

💡 Hint

Refer to variable_tracker and execution_table step 5 for pull behavior with trust enabled

Concept Snapshot

Content trust in Docker ensures images are signed and verified.
Enable with DOCKER_CONTENT_TRUST=1.
Sign images during push; verify on pull.
Unsigned images are rejected if trust is enabled.
Protects from running untrusted code.

Full Transcript

This visual execution shows how Docker content trust works. First, you build an image locally. Then you push it to a registry, where it gets signed using Notary. On the client side, you enable content trust by setting the environment variable DOCKER_CONTENT_TRUST=1. When you pull the image, Docker checks the signature. If the signature is valid, the image is pulled and can be run safely. If the image is unsigned and content trust is enabled, the pull fails to prevent running untrusted images. This process helps keep your Docker environment secure by verifying image authenticity.