Q: Your enterprise security guidelines require that production environments execute only container images digitally signed by approved CI/CD release pipelines. If an adversary compromises an internal registry and overwrites a tag (such as `api:v1.0`) with a trojanized image, Docker engines must refuse to pull or execute the corrupted image. You must implement Docker Content Trust (DCT), manage Notary root and repository keys, and enforce image verification on production nodes.

DCT is based on The Update Framework (TUF) and Notary. It uses a hierarchy of cryptographic keys: the Root Key (offline key of trust), Targets Key (signs image tags/digests), Snapshot Key (prevents replay/freeze attacks), and Timestamp Key (ensures freshness).

<!-- Key Hierarchy -->
Root Key (Kept Offline in HSM / Cold Storage)
  └── Targets Key (Signs image tags and hashes)
  └── Snapshot Key (Validates metadata consistency)
  └── Timestamp Key (Held by Notary server, prevents replay attacks)

Enable Docker Content Trust locally using `export DOCKER_CONTENT_TRUST=1`. Generate signing keys and initialize trust for your target repository.

# Enable Docker Content Trust in shell
export DOCKER_CONTENT_TRUST=1
export DOCKER_CONTENT_TRUST_SERVER="https://notary.internal.company:4443"

# Build and push signed image (prompts to generate Root & Targets passphrases)
docker build -t registry.internal.company/security/auth:v1.0 .
docker push registry.internal.company/security/auth:v1.0
# Output: Signing and pushing trust metadata for registry.internal.company/security/auth

Enable `DOCKER_CONTENT_TRUST=1` on production hosts. Attempt to run an unsigned or tampered image, and verify that Docker aborts execution with `Error: remote trust data does not exist`.

# On production host with DCT enabled:
export DOCKER_CONTENT_TRUST=1

# Running signed image succeeds:
docker pull registry.internal.company/security/auth:v1.0
# Status: Downloaded newer image for registry.internal.company/security/auth:v1.0

# Running unsigned image is blocked:
docker pull untrusted-registry.com/app:latest
# Error: remote trust data does not exist for untrusted-registry.com/app

Configure CI/CD runners with delegation signing keys (`docker trust signer add`) so automated pipelines can sign images using short-lived delegation certificates without exposing the master Root Key.

# Add CI delegation signer
docker trust signer add --key ci-signer.pub ci-builder registry.internal.company/security/auth