Skip to content

doi: add note about dct retirement #23246

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 15, 2025
+28 −0
Merged

doi: add note about dct retirement #23246

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions content/manuals/docker-hub/image-library/trusted-content.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,22 @@

## Docker Official Images

> [!NOTE]
>
> Docker is retiring Docker Content Trust (DCT) for Docker Official Images
> (DOI). Starting on August 8th, 2025, the oldest of DOI DCT signing

Check warning on line 24 in content/manuals/docker-hub/image-library/trusted-content.md

View workflow job for this annotation

GitHub Actions / validate (vale) 

[vale] reported by reviewdog 🐶
[Docker.Acronyms] 'DOI' has no definition.

Raw Output:
{"message": "[Docker.Acronyms] 'DOI' has no definition.", "location": {"path": "content/manuals/docker-hub/image-library/trusted-content.md", "range": {"start": {"line": 24, "column": 54}}}, "severity": "WARNING"}

Check warning on line 24 in content/manuals/docker-hub/image-library/trusted-content.md

View workflow job for this annotation

GitHub Actions / validate (vale) 

[vale] reported by reviewdog 🐶
[Docker.Acronyms] 'DOI' has no definition.

Raw Output:
{"message": "[Docker.Acronyms] 'DOI' has no definition.", "location": {"path": "content/manuals/docker-hub/image-library/trusted-content.md", "range": {"start": {"line": 24, "column": 4}}}, "severity": "WARNING"}
> certificates will begin to expire. You may have already started seeing expiry
> warnings if you use the `docker trust` commands with DOI. These certificates,

Check warning on line 26 in content/manuals/docker-hub/image-library/trusted-content.md

View workflow job for this annotation

GitHub Actions / validate (vale) 

[vale] reported by reviewdog 🐶
[Docker.Acronyms] 'DOI' has no definition.

Raw Output:
{"message": "[Docker.Acronyms] 'DOI' has no definition.", "location": {"path": "content/manuals/docker-hub/image-library/trusted-content.md", "range": {"start": {"line": 26, "column": 56}}}, "severity": "WARNING"}
> once cached by the Docker client, are not subsequently refreshed, making
> certificate rotation impractical. If you have set the `DOCKER_CONTENT_TRUST`
> environment variable to true (`DOCKER_CONTENT_TRUST=1`), DOI pulls will start to

Check warning on line 29 in content/manuals/docker-hub/image-library/trusted-content.md

View workflow job for this annotation

GitHub Actions / validate (vale) 

[vale] reported by reviewdog 🐶
[Docker.Acronyms] 'DOI' has no definition.

Raw Output:
{"message": "[Docker.Acronyms] 'DOI' has no definition.", "location": {"path": "content/manuals/docker-hub/image-library/trusted-content.md", "range": {"start": {"line": 29, "column": 60}}}, "severity": "WARNING"}
> fail. The workaround is to unset the `DOCKER_CONTENT_TRUST` environment
> variable. The use of `docker trust inspect` will also start to fail and should
> no longer be used for DOI.

Check warning on line 32 in content/manuals/docker-hub/image-library/trusted-content.md

View workflow job for this annotation

GitHub Actions / validate (vale) 

[vale] reported by reviewdog 🐶
[Docker.Acronyms] 'DOI' has no definition.

Raw Output:
{"message": "[Docker.Acronyms] 'DOI' has no definition.", "location": {"path": "content/manuals/docker-hub/image-library/trusted-content.md", "range": {"start": {"line": 32, "column": 25}}}, "severity": "WARNING"}
>
> For more details, see
> https://www.docker.com/blog/retiring-docker-content-trust/.

The Docker Official Images are a curated set of Docker repositories hosted on
Docker Hub.

Expand Down
12 changes: 12 additions & 0 deletions content/manuals/docker-hub/repos/manage/trusted-content/official-images.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,18 @@
- /docker-hub/official_images/
---

> [!NOTE]
>
> Docker is retiring Docker Content Trust (DCT) for Docker Official Images
> (DOI). You should start planning to transition to a different image signing

Check warning on line 16 in content/manuals/docker-hub/repos/manage/trusted-content/official-images.md

View workflow job for this annotation

GitHub Actions / validate (vale) 

[vale] reported by reviewdog 🐶
[Docker.Acronyms] 'DOI' has no definition.

Raw Output:
{"message": "[Docker.Acronyms] 'DOI' has no definition.", "location": {"path": "content/manuals/docker-hub/repos/manage/trusted-content/official-images.md", "range": {"start": {"line": 16, "column": 4}}}, "severity": "WARNING"}
> and verification solution (like [Sigstore](https://www.sigstore.dev/) or
> [Notation](https://github.com/notaryproject/notation#readme)). Docker will
> publish migration guides soon to help you in that effort. Timelines for the
> complete deprecation of DCT are being finalized and will be published soon.
>
> For more details, see
> https://www.docker.com/blog/retiring-docker-content-trust/.

Docker, Inc. sponsors a dedicated team that's responsible for reviewing and
publishing all content in Docker Official Images. This team works in
collaboration with upstream software maintainers, security experts, and the
Expand Down
Loading