How are docker images verified?

Question

A webpage article "Docker Image Insecurity" from December 2014 draws some worrying picture of the mechanisms in place for securing docker image integrity.

Is this something that has been improved upon in the meantime. If so a good answer would ideally be able to point to a documentation that illustrates the improvied image verification mechanisms and how to test them.

Answer 1

This has been addressed sometime around August 2015 by the introduction of Docker Content Trust.

DCT was introduced from Docker Engine 1.8 onwards and it makes it possible to verify the publisher of Docker images.

Before a publisher pushes an image to a remote registry, Docker Engine signs the image locally with the publisher's private key. When you later pull this image, Docker Engine uses the publisher's public key to verify that the image you are about to run is exactly what the publisher created, has not been tampered with and is up to date.

For more information please refer to the information here .

DCT incorporates Notary in the docker engine and Notary is based on " The Update Framework ", more can be read about them here