In this lesson, you will learn how to use Docker Content Trust (DCT) to digitally sign your images, ensuring that the code you push to your registry is exactly what your production servers pull.
Why Sign Your Images?
Imagine you push an image named myapp:latest to your registry. Without signing, a malicious actor could intercept that image or poison your registry, replacing it with a compromised version. Your production environment would blindly pull and run it, believing it came from you. Docker Content Trust solves this by using the Notary project to attach digital signatures to your image tags. When you enable DCT, Docker verifies these signatures against a public key before allowing an image to be pulled or run.
Enabling Content Trust
To start using DCT, you need to set an environment variable in your terminal session. This tells the Docker CLI to verify the signatures of images you pull:
export DOCKER_CONTENT_TRUST=1
Once enabled, any attempt to docker pull or docker run an image that has not been signed by the appropriate authority will result in an error, effectively blocking the execution of unverified code.
Signing an Image
When you push an image with DCT enabled, Docker will guide you through the process of generating a set of keys. You will be prompted to create a root passphrase (for the master key) and a repository passphrase (for the specific image).
When you run:
docker push my-registry.com/my-app:1.0.0
Docker calculates the cryptographic hash of your image layers, signs them with your private key, and sends that signature to the Notary server alongside your image. When your CI/CD pipeline or Kubernetes cluster attempts to pull this image, it checks the Notary server to confirm the signature matches the image content. If even a single byte has been altered, the signature validation fails, and the image is rejected.
This creates an immutable "chain of custody" for your artifacts. By implementing DCT, you ensure that only images verified by your private keys can ever reach your production environment, providing a critical layer of defense against supply chain attacks.
Key Takeaway: Docker Content Trust leverages Notary to digitally sign your images, ensuring that your production environment only runs authentic, untampered code.