Ensuring Container Image Integrity: Skopeo vs DCT

Container image security is critical as images progress through development, testing, and production. Signing container images verifies their origin and integrity, protecting against tampering or corruption.

Why Sign a Container Image?

Signing serves four essential purposes:

1. Integrity: Detects any modifications to the image since signing
2. Authenticity: Confirms the image originated from a trusted source
3. Security: Adds verification layers to the container supply chain
4. Compliance: Meets regulatory requirements for production deployments

Signing Images with Skopeo

Skopeo enables image signing across different registries using GPG keys.

Steps to Sign an Image with Skopeo

1. Install Skopeo and GPG

sudo apt update
sudo apt install -y skopeo gpg

2. Create a GPG Key

gpg --gen-key

3. Export Your GPG Key

gpg --armor --export YOUR-EMAIL@EXAMPLE.COM > ~/mykey.gpg

4. Configure Signature Policies

mkdir -p ~/.config/containers
nano ~/.config/containers/policy.json

Add the following content:

{
  "default": [
    {
      "type": "insecureAcceptAnything"
    }
  ],
  "transports": {
    "docker": {
      "docker.io/your-repo/your-image": [
        {
          "type": "signedBy",
          "keyType": "GPGKeys",
          "keyPath": "/path/to/mykey.gpg"
        }
      ]
    }
  }
}

5. Sign the Image

skopeo copy --sign-by YOUR-EMAIL@EXAMPLE.COM \
  docker://docker.io/your-repo/your-image:latest \
  docker://docker.io/your-repo/your-image:latest

6. Verify the Signature

skopeo inspect --config docker://docker.io/your-repo/your-image:latest

Signing Images with Docker Content Trust (DCT)

Docker Content Trust integrates Notary for comprehensive image management and signing within the Docker ecosystem.

Steps to Sign an Image with Docker Content Trust

1. Enable Docker Content Trust

export DOCKER_CONTENT_TRUST=1

2. Push the Image

docker push docker.io/your-repo/your-image:latest

3. Verify the Signature

docker trust inspect --pretty docker.io/your-repo/your-image:latest

Comparing Skopeo and Docker Content Trust

Skopeo

• Flexibility: Supports multiple registries with GPG key customization
• Independence: Operates without Docker dependency
• Manual Configuration: Requires GPG setup and policy configuration

Docker Content Trust (DCT)

• Integration: Seamlessly embedded in Docker workflows
• Ease of Use: Minimal configuration; automatic signing when enabled
• Managed Keys: Notary handles key management with less flexibility

Compatibility

Images signed with Skopeo are not recognized by Docker Content Trust and vice versa. Each system uses incompatible signing methods.

What to Use When

Use Skopeo if:

• Working with multiple registries requiring registry-agnostic flexibility
• Preferring GPG-based signing
• Needing Docker-independent tools

Use Docker Content Trust if:

• Primarily using Docker in your workflow
• Wanting automatic key management
• Preferring environment variable simplicity

By signing container images, organizations add crucial security layers ensuring only trusted images reach production environments.