- [Instructor] In the Docker Certified Associate
Exam study guide, there are two objectives in security
that we should be aware of.
First is how to enable Docker Content Trust,
and second is to be able to describe the process
of signing an image.
And that's exactly what we're going to cover in this video.
First off, let's answer the question,
what is Docker Content Trust?
Well, it's important to know that the image
that you try to pull, that you want,
is the image that you actually receive.
And this is especially true when pulling images
from internet sites or across large corporate networks,
especially very critical images, images that are critical
to your company's production applications.
Now Docker has an opensource project called Docker Notary,
and it allows you to digitally sign content,
and Notary is actually part of, by default,
the Docker Trusted Registry.
Now the purpose of Notary is to enforce a policy
that any operations when you talk to a remote registry,
whether you're pulling down an image,
that that image is required to be signed,
or if you're pushing up an image,
that you attempt to digitally sign that image.
So, to enable Docker Content Trust, it's very easy.
You do it in any Docker client simply by using the command,
export DOCKER_CONTENT_TRUST, and setting it to one.
That enables Docker Content Trust.
So it's an environmental variable.
If you log out, that environmental variable will be gone,
and Docker Content Trust by default will be off
the next time you log in.
So once Docker Content Trust is enabled
with the environmental variable,
the Docker push will try to sign an image,
and the Docker pull will only download signed images.
Now what you can so with UCP is you can ensure
that only signed images can be run.
So let me show you how to do all of this.
We'll start first over at the command line interface
in the Docker client.
So here in the Docker client,
if I do a docker image ls, let's pipe that to more,
I've got an image called nginx, nginx:latest.
So what we're going to do is to tag that image.
We'll take nginx:latest, and we're going to tag it
with our Docker Trusted Registry server, /david,
which is the repository there, /test.
And then we're going to tag it with signed.
And it doesn't have to be signed.
It can be any tag.
And then we're going to export DOCKER_CONTENT_TRUST=1.
Let's echo DOCKER_CONTENT_TRUST.
It is set, it is set to one.
Now let's make sure that we're logged in
to our Docker Trusted Registry server.
Username is david, I'll type in the password.
We were actually already logged in,
but we just wanna double check.
And now let's do a docker push
on the new image that we tagged.
Alright, and it tries to push that,
and we get this error at the bottom that says,
error contacting notary server,
certificate signed by unknown authority.
That's because we're using self-signed certificates.
And so that error is to be expected,
because we don't have publicly signed certificates
installed at this point.
So what happened was the image was pushed up,
but the signing of the image actually failed in this case.
So, let's say that we go over to another Docker host,
and on another Docker host,
let's say that we try to first enable Content Trust,
or we do enable Content Trust, and then we try
to pull down this image that was pushed up,
the signed image, or supposedly signed image, right?
So we try to pull that down,
and we get again, the same error.
Error contacting notary server,
certificate signed by unknown authority.
Again, we're using self-signed certificates,
and that image was not properly signed.
So because Content Trust is enabled,
we're not able to pull down images that are unsigned.
Now if we go back and we disable Content Trust,
and rerun the pull command, there we go.
We are successfully pulling down that image.
So that's the basic concept of Docker Content Trust.
Now, with the Universal Control Plane,
it can take this to a whole 'nother level.
Let's go over into UCP.
So here in Docker's Universal Control Plane,
one of the cool things you can do,
is you can go into the administrative settings,
if you're an administrator,
and then into Docker Content Trust,
and with a single check box, I can check
that we will only run signed images on Docker nodes
that are managed by this Universal Control Plane,
or this UCP installation.
And then what we need to do here
is we need to select an organization
and then a team in the org, and signatures
from all teams listed will be required.
So we have to go into, let's say IT,
and then we select developers, and click save.
Alright, so we just configured UCP
to run only signed images.
This is a very cool feature of the Universal Control Plane.
And you saw how easy it was, of course,
to go to any Docker client, and export the variable
DOCKER_CONTENT_TRUST=1 to enable Docker Content Trust.