About Docker Content Trust

--- description: Enabling content trust in Docker keywords: content, trust, security, docker, documentation title: Content trust in Docker aliases: - /engine/security/trust/content_trust/ - /notary/getting_started/ - /notary/advanced_usage/ - /notary/service_architecture/ - /notary/running_a_service/ - /notary/changelog/ - /notary/reference/server-config/ - /notary/reference/signer-config/ - /notary/reference/client-config/ - /notary/reference/common-configs/ --- When transferring data among networked systems, trust is a central concern. In particular, when communicating over an untrusted medium such as the internet, it is critical to ensure the integrity and the publisher of all the data a system operates on. You use Docker Engine to push and pull images (data) to a public or private registry. Content trust gives you the ability to verify both the integrity and the publisher of all the data received from a registry over any channel. ## About Docker Content Trust (DCT) Docker Content Trust (DCT) provides the ability to use digital signatures for data sent to and received from remote Docker registries. These signatures allow client-side or runtime verification of the integrity and publisher of specific image tags. Through DCT, image publishers can sign their images and image consumers can ensure that the images they pull are signed. Publishers could be individuals or organizations manually signing their content or automated software supply chains signing content as part of their release process. ### Image tags and DCT An individual image record has the following identifier: ```text [REGISTRY_HOST[:REGISTRY_PORT]/]REPOSITORY[:TAG] ``` A particular image `REPOSITORY` can have multiple tags. For example, `latest` and `3.1.2` are both tags on the `mongo` image. An image publisher can build an image and tag combination many times changing the image with each build. DCT is associated with the `TAG` portion of an image. Each image repository has a set of keys that image publishers use to sign an image tag. Image publishers have discretion on which tags they sign. An image repository can contain an image with one tag that is signed and another tag that is not. For example, consider [the Mongo image repository](https://hub.docker.com/r/library/mongo/tags/). The `latest` tag could be unsigned while the `3.1.6` tag could be signed. It is the responsibility of the image publisher to decide if an image tag is signed or not. In this representation, some image tags are signed, others are not:

Docker Content Trust (DCT) uses digital signatures to verify the integrity and publisher of Docker images sent to and received from remote registries. DCT is associated with image tags, and publishers can choose which tags to sign. Image repositories can have both signed and unsigned tags, and it is up to the publisher to decide whether a tag is signed or not.