Docker Content Trust
A Docker client feature that signed image tags on push and refused unsigned tags on pull, built on Notary.
In more detail
It was enabled with the environment variable DOCKER_CONTENT_TRUST=1 and managed with docker trust commands and a set of signing keys. Docker CLI 29 removed it, and the Notary service at notary.docker.io shuts down on 8 December 2026. The Docker Certified Associate exam still tests it.
Related terms
- Notary — An open source service and client for signing content and verifying signatures, used by Docker Content Trust.
- Docker Certified Associate — A Docker certification exam, now owned and sold by Mirantis, that tests orchestration, images, installation, networking, security and storage.
Taught in
- Our Own Registry: Deploy, Push, Pull, Search And Delete — Docker Certified Associate (DCA) Exam Prep
- Four Questions From The Auditor: Swarm Security, Autolock And Content Trust — Docker Certified Associate (DCA) Exam Prep
- Security Sprint: Eight Questions On Defaults, Trust And Access — Docker Certified Associate (DCA) Exam Prep
- The Night Before: Final Review And Exam Day — Docker Certified Associate (DCA) Exam Prep