Docker Content Trust on an Anubiz Offshore VPS
Docker Content Trust (DCT) requires that every image pulled be signed by a key your machine trusts. Unsigned or unknown-publisher images are rejected. On an Anubiz VPS this prevents typo-squat attacks and supply-chain image swaps. This guide enables DCT, signs your own images with Notary v1 (or transitions to cosign/sigstore for new workflows), and integrates with CI.
Need this done for your project?
We implement, you ship. Async, documented, done in days.
Step 1: Enable DCT
export DOCKER_CONTENT_TRUST=1. Add to /etc/environment for system-wide enforcement.
Step 2: Generate Keys
First docker push triggers root and repo key generation. Root key offline storage critical. Repo key per project.
Step 3: Sign on Push
With DCT enabled, every push signs automatically. Verify in registry: tag has signature attached.
Step 4: Cosign Alternative
Notary v1 is legacy. New projects use cosign with sigstore: cosign sign and cosign verify. Policy via Kyverno or admission webhooks in k8s.
Step 5: CI Integration
CI runner needs the signing key, ideally via short-lived token from a secrets manager. Never commit keys to repo.
Related Services
Why Anubiz Host
Ready to get started?
Skip the research. Tell us what you need, and we'll scope it, implement it, and hand it back — fully documented and production-ready.