What is Docker Image Signature and how to use Docker Content Trust to verify image authenticity?

Docker Content Trust (DCT) is a cryptographic verification mechanism for digital signatures of all images pushed to and pulled from registries like Docker Hub. Using DCT guarantees that you are downloading the exact image built by the official publisher or your development team, rather than a malicious copy substituted by an attacker during a software supply chain attack.

The working principle is based on a pair of private and public cryptographic keys. When a developer publishes a signed image, the local Docker daemon creates a digital signature for the image manifest and sends it to a dedicated trust server in the repository. When attempting to pull such an image, the client software automatically checks the validity of the signature before allowing the container to be created and run.

To enable this feature on your workstation, simply set the DOCKER_CONTENT_TRUST environment variable to one using the export command in the terminal. After that, any standard build, tag, and push commands, such as docker push or docker pull, will require generating root and repository security keys, as well as entering passwords to confirm them.

If the image signature is missing, damaged, or does not match the organization's trusted key, Docker will abort the download process with a security error and prevent potentially dangerous code from running. This is critical for complying with corporate security standards and protecting production environments from the introduction of unauthorized changes during the application delivery phase.