How to prevent unsigned Docker images from being pulled

Make sure you're only pulling down signed Docker images with Content Trust enabled.

You've probably heard the stories about malicious Docker images being discovered within various repositories. Some of these images range from those containing actual malware/spyware/ransomeware/etc, to the less malicious images that contain root accounts that cannot be fully trusted. Either way, you should not use these images.

More about cybersecurity

The problem is, how does one know if an image contains malicious code? Without building images yourself or going through the arduous process of getting individual images scanned, what can you do?

SEE: Windows 10 security: A guide for business leaders (TechRepublic Premium)

Simply put, you can configure Docker such that a Docker pull command will only succeed if the image being pulled has been signed by the creator. This, of course, isn't a perfect solution, but it will prevent you (or your developers) from pulling down unsigned images from repositories. These image signatures allow for the client-side or runtime verification of the integrity and creator of specific images and image tags.

How this works is with the Docker Content Trust feature that arrived in Docker 1.8, and it's actually quite easy to implement. I'll demonstrate this on Ubuntu Server 18.04, but the process should work fine on any platform running Docker 1.8 or newer.

How this works

Once you've enabled content trust, if you attempt to pull down an unsigned image, you'll get an error, and the image will not pull (Figure A).

Figure A: Pulling an unsigned image is a no-go.

With Content Trust in place, the only images that you can pull are signed (Figure B).

Figure B: The official NGINX image pulls down fine.

Enabling content trust

The first thing to do is enable content trust. You can do this on a temporary basis by opening a terminal window and issuing the command:

export DOCKER_CONTENT_TRUST=1

Once you do that, Content Trust is working, and you cannot pull down unsigned images. However, using the above method only works in the current shell. As soon as you log out and log back in, you'll be able to pull down unsigned images without a problem. To make this permanent, open a terminal window, issue the command sudo nano /etc/environment and add the following to the bottom of the file:

DOCKER_CONTENT_TRUST=1

Save and close that file. Log out and log back in as much as you want, and Content Trust will still be enabled. Your Docker pull commands will only succeed if you're pulling down signed images.

The caveat

This is not a foolproof solution. Why? Because Docker includes an option that allows you to circumvent the Content Trust feature. Say, for example, you want to pull an unsigned image from Docker Hub (without disabling the environment variable set earlier). You can do this with the command:

docker pull --disable-content-trust nginx/unit

As you can see (Figure C), if you attempt to pull that image without the —disable-content-trust option, the pull will fail. With the option, it succeeds.

Figure C: Circumventing Content Trust.

A wise addition

Although there may be instances where you want to get around the Content Trust feature, it's always good to enable it, so you're only pulling down signed images. It's not a perfect security solution for Docker, but it's a small step forward for you container deployment.

Cybersecurity Insider Newsletter

Strengthen your organization's IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices. Delivered Tuesdays and Thursdays

Sign up today Sign up today

Also see

Docker