DCA · Question #77
You configure a local Docker engine to enforce content trust by setting the environment variable DOCKER_CONTENT_TRUST=1. If myorg/myimage: 1.0 is unsigned, does Docker block this command? Solution…
The correct answer is A. Yes. With Docker Content Trust enabled, docker image import will be blocked for unsigned images, as Content Trust may enforce signature requirements for all images, including locally created ones.
Question
You configure a local Docker engine to enforce content trust by setting the environment variable DOCKER_CONTENT_TRUST=1. If myorg/myimage: 1.0 is unsigned, does Docker block this command? Solution: docker image import <tarball> myorg/myimage:1.0
Options
- AYes
- BNo
How the community answered
(17 responses)- A82% (14)
- B18% (3)
Why each option
With Docker Content Trust enabled, `docker image import` will be blocked for unsigned images, as Content Trust may enforce signature requirements for all images, including locally created ones.
When `DOCKER_CONTENT_TRUST=1` is enforced, Docker's content trust mechanism can extend to all operations that introduce new images to the local image store. Since `docker image import` creates a new image from a local tarball, and this imported image would inherently lack a trusted signature, Docker will block the command to prevent untrusted content from becoming part of the local image inventory.
Even for locally imported images, Docker Content Trust, when enabled, might impose a requirement for image signatures, leading to the blocking of unsigned imports.
Concept tested: Docker Content Trust scope for local image imports
Source: https://docs.docker.com/engine/security/trust/content_trust/
Topics
Community Discussion
No community discussion yet for this question.