Docker is looking to improve container security with a newly announced capability in Docker 1.8: Docker Content Trust. The feature uses digital signatures to secure Dockerized content.
“As organizations evolve from a monolithic software architecture to distributed applications, the secure distribution of software becomes increasingly difficult to solve,” said Diogo Mónica, security lead for Docker. “Without a standard method for validating the integrity of content, Docker has the unique opportunity to leapfrog the status quo and build a system that meets the strongest standard for software distribution. With Docker Content Trust, users have a solution that works across any infrastructure, offering security guarantees that were not previously available to them.”
(Related: Docker and the ‘coolification’ of containers)
Based on Notary and the Update Framework, Docker Content Trust seamlessly integrates into existing workflows and doesn’t require the need to learn new commands or security principles, according to Docker.
The framework has two distinct keys: an offline key and a tagging key. The tagging key gets generated for each unique repository a publisher owns, and it allows the publisher to digitally sign Docker images to a particular repository. According to Docker, since the tagging key is online, it is vulnerable to attack. Publishers can securely rotate compromised keys with the offline key.
“Keys are the critical component to sign and verify trusted content for your repositories. It is very important that you back up these keys to a safe and secure location,” Mónica wrote in a blog post.
In addition, the framework generates a timestamp key to protect against replay attacks.
