Building and Signing Multi-Arch Images with Buildx + DCT

When building multi-architecture Docker images, the common practice of using the --push option with Docker Buildx directly pushes the images to the registry without signing them, even if the DOCKER_CONTENT_TRUST environment variable is set to 1. This article shows how to work around this limitation.

Step 1: Enable Docker Content Trust

export DOCKER_CONTENT_TRUST=1

Step 2: Create and Use a Docker Buildx Builder

docker buildx create --name mybuilder --use
docker buildx inspect --bootstrap

Step 3: Build and Push Multi-Architecture Images

Build and push images separately for each architecture:

# Build and push for amd64
docker buildx build --platform linux/amd64 -t docker.io/your-repo/your-image:amd64 --push .

# Build and push for arm64
docker buildx build --platform linux/arm64 -t docker.io/your-repo/your-image:arm64 --push .

Step 4: Create and Push a Multi-Architecture Manifest

# Create a multi-architecture manifest
docker manifest create docker.io/your-repo/your-image:latest \
  docker.io/your-repo/your-image:amd64 \
  docker.io/your-repo/your-image:arm64

# Annotate the images (optional but recommended)
docker manifest annotate docker.io/your-repo/your-image:latest \
  docker.io/your-repo/your-image:amd64 --arch amd64
docker manifest annotate docker.io/your-repo/your-image:latest \
  docker.io/your-repo/your-image:arm64 --arch arm64

# Push the multi-architecture manifest
docker manifest push docker.io/your-repo/your-image:latest

Step 5: Verify the Signatures

docker trust inspect --pretty docker.io/your-repo/your-image:latest

Conclusion

By building each architecture separately and creating a manifest manually, we can combine multi-architecture support with Docker Content Trust signing. This ensures that every image pushed to the registry is signed and verified, which is essential for secure CI/CD pipelines.