zoom_in Click to enlarge

Docker Content Trust

▲ ▼

language

description Docker Content Trust Overview

Docker Content Trust uses digital signatures to verify the integrity and origin of Docker images, ensuring users receive authentic software from trusted publishers and preventing tampering or malicious substitutions.

help Docker Content Trust FAQ

What happens when I set DOCKER_CONTENT_TRUST=1 before pulling an image?

The Docker client will only pull, run, create, build, or push tagged images that have trusted signatures, unless you use an explicit content digest. For example, a signed tag can pass while an unsigned `latest` tag is rejected. [Docker Content Trust](https://docs.docker.com/engine/security/trust/)

Which keys does Docker Content Trust use to sign an image tag?

A Docker Content Trust key set includes an offline root key, repository or tagging keys, and a server-managed timestamp key. Docker warns that losing the root key is not recoverable, so it should be backed up offline. [Docker Content Trust keys](https://docs.docker.com/engine/security/trust/)

Does Docker Content Trust verify that a signed image tag came from the expected publisher?

Yes, Docker Content Trust verifies the integrity and publisher information attached to signed image tags. A content digest is still the better reference when a deployment must identify the exact image bytes rather than rely on a mutable tag. [Docker Content Trust](https://docs.docker.com/engine/security/trust/)

Is Docker Content Trust still supported for new systems?

Docker's current documentation says Docker Content Trust is being retired and that the Notary v1 service at `notary.docker.io` will shut down on December 8, 2026. Teams starting a new signing system should account for that announced end date. [Docker Content Trust warning](https://docs.docker.com/engine/security/trust/)

swap_horiz

Looking for Docker Content Trust alternatives? Compare top competitors ranked & scored

arrow_forward