DCA · Question #78
You configure a local Docker engine to enforce content trust by setting the environment variable DOCKER_CONTENT_TRUST=1. If myorg/myimage: 1.0 is unsigned, does Docker block this command? Solution: do
The correct answer is B. No. Docker Content Trust checks occur during image pulls from a registry; if the image is already locally available, docker service create will proceed without re-verifying the signature.
Question
You configure a local Docker engine to enforce content trust by setting the environment variable DOCKER_CONTENT_TRUST=1. If myorg/myimage: 1.0 is unsigned, does Docker block this command? Solution: docker service create myorg/myimage:1.0
Options
- AYes
- BNo
How the community answered
(24 responses)- A25% (6)
- B75% (18)
Why each option
Docker Content Trust checks occur during image pulls from a registry; if the image is already locally available, `docker service create` will proceed without re-verifying the signature.
Content trust checks are primarily for `pull` operations from a registry; if the image is already available locally, `docker service create` does not initiate a new trust verification.
The `docker service create` command will only trigger a Docker Content Trust check if it needs to pull the image from a remote registry. If `myorg/myimage:1.0` is already present in the local Docker image cache (e.g., it was built locally or pulled previously when content trust was disabled), the command will execute without attempting to re-pull or verify a signature.
Concept tested: Docker Content Trust on service creation vs. image pull
Source: https://docs.docker.com/engine/security/trust/content_trust/
Topics
Community Discussion
No community discussion yet for this question.