Docker Content Trust Decommissioning and Migration Guide

Vulnerability Overview Docker Content Trust (DCT) and the Notary v1 service (notary.docker.io) are being fully retired. DCT was an early tool in the Docker container ecosystem used to verify image integrity and publisher identity, based on the upstream Notary v1 server, which has not been maintained since its initial release in 2015. With the adoption of OCI-native signing tools (such as Sigstore/Cosign and Notation from the Notary Project), DCT is no longer the standard. Impact Scope Affected Users: Users configured with DCT, including those who have set the environment variable, use the command, employ Kubernetes admission controllers or deployment strategies to check DCT signatures, or use DCT signatures to publish images. Unaffected Users: Users who have not set and do not use the command. Remediation 1. Ensure Image Pulls Succeed: - Disable DCT by setting the environment variable. - Search for and remove all instances of settings, including shell configuration files, CI/CD configurations, Compose files, and Kubernetes manifests. 2. Ensure Reproducible Pulls: - Use image digests for pulling to ensure that the same image content is retrieved each time. - Example code: 3. Verify Publisher Identity: - Use Sigstore/Cosign or Notation for image signing. - Sigstore/Cosign: - Quickstart: Sigstore Quickstart - GitHub Repository: Cosign on GitHub - Notation: - Quickstart: Notation Quickstart - GitHub Repository: Notation on GitHub 4. Enforce Verification in Production Environments: - Kyverno (paired with Cosign): - Verify Cosign signatures before pulling images. - Documentation: Kyverno Documentation - Ratify + Gatekeeper (paired with Notation): - Verify Notation signatures before admission of pods. - Setup Guide: Ratify Quickstart 5. Use Docker Hardened Images as a Built-in Alternative: - Docker Hardened Images (DHI) provide cryptographic signing, provenance, and SBOMs to ensure image integrity and security. - More Information: Docker Hardened Images - Free Catalog: DHI Catalog Need Help? Docker Hub Publishers: Need to adopt Cosign or Notation to self-sign images. Third-Party Image Consumers: Contact publishers to determine if they plan to adopt modern signing schemes. Questions or Migration Plans: Contact the Docker Support team. About the Authors Julia Wilson: UX Researcher, Docker Aditya Tripathi: Senior Product Marketing Manager, Docker Timeline July 14, 2026: 4-hour write interruption July 15, 2026: 4-hour write interruption August 10, 2026: 4-hour read interruption August 12, 2026: 4-hour read interruption December 8, 2026: Complete shutdown Summary Docker Content Trust (DCT) and the Notary v1 service are being retired. Users are advised to migrate to more modern signing tools such as Sigstore/Cosign or Notation to ensure image security and integrity.

Goal Reached Thanks to every supporter — we hit 100%!

Docker Content Trust Decommissioning and Migration Guide