SecurityIntermediate

Docker Content Trust Cheatsheet

Sign and verify images with Notary. Enforce image integrity across your supply chain.

What it is

Docker Content Trust (DCT) uses The Update Framework (TUF) and Notary to sign container images, guaranteeing that only verified images are pulled and run.

Quick start

export DOCKER_CONTENT_TRUST=1

Enable content trust for all docker commands.

docker trust sign myuser/myapp:1.0

Sign an image with your key.

docker trust inspect --pretty myuser/myapp:1.0

View signing information for an image.

Common commands

Task	Command	Description
Enable DCT	`export DOCKER_CONTENT_TRUST=1`	Enforce signing for all docker CLI operations.
Sign image	`docker trust sign <image>:<tag>`	Sign an image tag with your delegation key.
Inspect trust	`docker trust inspect --pretty <image>`	Show signers, keys, and signed tags.
Add signer	`docker trust signer add --key cert.pem <signer> <repo>`	Authorize a new signer for a repository.
Remove signer	`docker trust signer remove <signer> <repo>`	Revoke a signer's access.
Revoke tag	`docker trust revoke <image>:<tag>`	Remove the signature from a tag.

Real-world examples

Sign and push with DCT enabled

export DOCKER_CONTENT_TRUST=1
docker build -t myuser/myapp:1.0 .
docker push myuser/myapp:1.0  # Signs automatically

Best practices

Set DOCKER_CONTENT_TRUST=1 in CI/CD pipelines to enforce signed images.
Store delegation keys securely — losing them means you can't sign new tags.
Use DCT alongside Docker Scout for full supply-chain security.

Related cheatsheets

Last reviewed: 2026-06-15