4 ms·
Can anyone from Docker speak to the status of content trust? The fact that I can still `docker pull whatever` without explicitly trusting the source seems to co
by Perceptes 10y ago
Can anyone from Docker speak to the status of content trust? The fact that I can still `docker pull whatever` without explicitly trusting the source seems to conflict with the chart in this post. Will/shouldn't content trust be turned on by default at some point?
- justincormack 10y agoYes that is the plan, once everything is in place. The next step is to turn it on for official images (which are all signed now).
- endophage 10y agoTo add to Justin's comment, we merged what we've called "trust pinning" into Notary. We're still iterating on exactly the right scopes to pin to, but anticipate that making it into docker in the not too distant future. That will enable you to hard fail when pulling images not signed by an explicitly approved source.