Warning: In correlation with the end of life (EOL) date for MSR 3.1.x, Mirantis stopped maintaining this documentation version as of 2025-09-27. The latest MSR product documentation is available here.

Sign images with Docker Content Trust

Docker Content Trust (DCT) allows you to sign image tags, thus giving consumers a way to verify the integrity of your images. Users interact with DCT using a combination of docker trust and notary commands.

• Configure image signing
  • Enable DCT
  • Trust MSR CA certificate
  • Configure repository for signing
• Sign an image
• Add an additional signer
• Delete trust data
• Delete signed images
• Using Docker Content Trust with a Remote MKE Cluster
  • Prerequisites
  • Registering MSR with a remote Mirantis Kubernetes Engine
  • Signing an image in MSR
  • Enforce Signed Image Tags on the Remote MKE
  • Troubleshooting
    • Example Errors
      • Image or trust data does not exist
      • Image did not meet required signing policy
      • MSR URL must be a registered trusted registry