Docker Docker Registry and Repository Image Signing and Trust Content Trust DCT

1. Core Command / Concept

Image signing and trust (Content Trust – DCT) verifies the integrity and authenticity of Docker images. docker trust.

2. Step-by-Step

1. Check if Docker Content Trust is enabled: docker trust key list
   Output: A list of available keys or an error message if not enabled.
2. Enable Docker Content Trust: docker trust key generate
   Output: A new key is generated and stored in the default keyring.
3. Create a new key: docker trust key create mykey
   Output: A new key is created and stored in the default keyring.
4. Add a key to the keyring: docker trust key load mykey
   Output: The key is added to the keyring.
5. Sign an image: docker trust sign myimage
   Output: The image is signed with the default key.
6. Verify an image: docker trust inspect myimage
   Output: The image's trust information is displayed.
7. Remove a key from the keyring: docker trust key remove mykey
   Output: The key is removed from the keyring.
8. Clean up: docker system prune -af
   ⚠️ This deletes all stopped containers, images, volumes, and networks.

3. Real Commands with Examples

Example 1: Signing an Image

Purpose: Sign a Docker image with a key.
Command: docker trust sign myimage --key mykey Flags: --key specifies the key to use for signing.

Example 2: Verifying an Image

Purpose: Verify the trust information of a Docker image.
Command: docker trust inspect myimage Flags: None.

Example 3: Adding a Key to the Keyring

Purpose: Add a key to the default keyring.
Command: docker trust key load mykey Flags: None.

4. Common Errors

Error 1: Key not found

Error message: Error: key not found Why it happens: The key is not in the keyring.
Fix: docker trust key load mykey

Error 2: Image not signed

Error message: Error: image not signed Why it happens: The image is not signed with a key.
Fix: docker trust sign myimage --key mykey

Error 3: Keyring not initialized

Error message: Error: keyring not initialized Why it happens: The keyring is not initialized.
Fix: docker trust key generate

5. Quick Checks

Scenario 1: Image signed

Situation: You want to verify if an image is signed.
Command: docker trust inspect myimage Correct response: The image's trust information is displayed.

Scenario 2: Keyring initialized

Situation: You want to check if the keyring is initialized.
Command: docker trust key list Correct response: A list of available keys is displayed.

Scenario 3: Image not signed

Situation: You want to check if an image is signed.
Command: docker trust inspect myimage Correct response: An error message is displayed indicating the image is not signed.

6. Last-Minute Reference

• Docker Content Trust is enabled by default in Docker 1.13 and later.
• The default keyring is stored in ~/.docker/trust/keyring.
• Use docker trust key generate to initialize the keyring.
• Use docker trust key load to add a key to the keyring.
• Use docker trust sign to sign an image with a key.
• Use docker trust inspect to verify an image's trust information.
• Use docker trust key remove to remove a key from the keyring.
• Use docker system prune -af to clean up.
• ⚠️ Docker Content Trust is not enabled by default in Docker versions prior to 1.13.
• ⚠️ The default keyring is not initialized by default in Docker versions prior to 1.13.