[Security] Is it time to sign the Docker images ?? #1022

New Issue

GiteaMirror · 2025-11-07T06:55:23-06:00

GiteaMirror commented

2025-11-07 06:55:23 -06:00

Originally created by @williamdes on GitHub (Apr 30, 2021).

Subject of the issue

Docker images when signed are more "secure" in the case of a security event because a non signed image could not be pulled if the previous one was signed.

Deployment environment

Docker

Steps to reproduce

docker pull vaultwarden/server:latest --disable-content-trust=false

Error: remote trust data does not exist for docker.io/vaultwarden/server: notary.docker.io does not have trust data for docker.io/vaultwarden/server

Expected behaviour

Have a signed image I can trust

Actual behaviour

No signed image

Troubleshooting data

All needed information can be found in official docs and in the GitHub action: https://github.com/sudo-bot/action-docker-sign

All the needed commands can be copied from https://github.com/sudo-bot/action-docker-sign/blob/main/action.yml

Is it easy to implement: Yes

Do you have to backup in a very safe place the repository and root keys, YES !!

Knowing nothing about DCT I implemented a GitHub action in a bunch of hours, I can provide help for the setup if needed

Originally created by @williamdes on GitHub (Apr 30, 2021). ### Subject of the issue Docker images when [signed](https://docs.docker.com/engine/security/trust/) are more "secure" in the case of a security event because a non signed image could not be pulled if the previous one was signed. ### Deployment environment Docker ### Steps to reproduce ``` docker pull vaultwarden/server:latest --disable-content-trust=false ``` ``` Error: remote trust data does not exist for docker.io/vaultwarden/server: notary.docker.io does not have trust data for docker.io/vaultwarden/server ``` ### Expected behaviour Have a signed image I can trust ### Actual behaviour No signed image ### Troubleshooting data All needed information can be found in official docs and in the GitHub action: https://github.com/sudo-bot/action-docker-sign All the needed commands can be copied from https://github.com/sudo-bot/action-docker-sign/blob/main/action.yml Is it easy to implement: Yes Do you have to backup in a very safe place the repository and root keys, YES !! Knowing nothing about DCT I implemented a GitHub action in a bunch of hours, I can provide help for the setup if needed

GiteaMirror closed this issue

2025-11-07 06:55:23 -06:00

GiteaMirror commented

2025-11-07 06:55:24 -06:00

@williamdes commented on GitHub (Apr 30, 2021):

You can find examples on https://github.com/sudo-bot/action-docker-sign#inspect-trust

@williamdes commented on GitHub (Apr 30, 2021): You can find examples on https://github.com/sudo-bot/action-docker-sign#inspect-trust

GiteaMirror commented

2025-11-07 06:55:24 -06:00

@dani-garcia commented on GitHub (Apr 30, 2021):

As our images are getting built automatically by Docker Hub's infrastructure, enabling this would imply giving them the private signing key directly, so would this add any extra security in that case?

@dani-garcia commented on GitHub (Apr 30, 2021): As our images are getting built automatically by Docker Hub's infrastructure, enabling this would imply giving them the private signing key directly, so would this add any extra security in that case?

GiteaMirror commented

2025-11-07 06:55:24 -06:00

@williamdes commented on GitHub (Apr 30, 2021):

As our images are getting built automatically by Docker Hub's infrastructure, enabling this would imply giving them the private signing key directly, so would this add any extra security in that case?

Well, the auto-builds are not possible anymore with that option. The repository would need to build the images :/

@williamdes commented on GitHub (Apr 30, 2021): > As our images are getting built automatically by Docker Hub's infrastructure, enabling this would imply giving them the private signing key directly, so would this add any extra security in that case? Well, the auto-builds are not possible anymore with that option. The repository would need to build the images :/

GiteaMirror commented

2025-11-07 06:55:24 -06:00

@williamdes commented on GitHub (Apr 30, 2021):

Switching to Images build with GitHub actions using a named env with run approvers seems to be the solution to make the secrets protected :)

@williamdes commented on GitHub (Apr 30, 2021): Switching to Images build with GitHub actions using a named env with run approvers seems to be the solution to make the secrets protected :)

GiteaMirror commented

2025-11-07 06:55:25 -06:00

@williamdes commented on GitHub (May 8, 2021):

Do you think this could get implemented ?
I did add all the needed instructions for multi arch images on my repository

@williamdes commented on GitHub (May 8, 2021): Do you think this could get implemented ? I did add all the needed instructions for multi arch images on my repository

GiteaMirror commented

2025-11-07 06:55:25 -06:00

@BlackDex commented on GitHub (Jun 21, 2021):

I'm going to move this to the discussions under Ideas, also to keep the issues for actual issues to the software.

@BlackDex commented on GitHub (Jun 21, 2021): I'm going to move this to the discussions under `Ideas`, also to keep the issues for actual issues to the software.