Configure Docker Content Trust

Step 1 - Start Registry Server

docker-compose up -d

Step 2 - Start Notary Server

docker run -it -v /var/run/docker.sock:/var/run/docker.sock \ --link notary_notaryserver_1:notaryserver \ --link sandboxregistry:sandboxregistry \ notarysandbox

Keys?

Step 3 - Pull Image

docker pull docker/trusttest

Step 4 - Push Signed Image

docker tag docker/trusttest registry.test.training.katacoda.com:5000/test/trusttest:latest

export DOCKER_CONTENT_TRUST=1 export DOCKER_CONTENT_TRUST_SERVER=https://notary.test.training.katacoda.com:4443

docker push registry.test.training.katacoda.com:5000/test/trusttest:latest

Step 5 - Hack Signed Docker Image

docker pull registry.test.training.katacoda.com:5000/test/trusttest:latest

docker exec -it sandboxregistry bash

cd /var/lib/registry/docker/registry/v2/blobs/sha256/

echo "Malicious data" > data

Step 6 - Test Layer Verification

docker pull registry.test.training.katacoda.com:5000/test/trusttest:latest

cd <directory>	Change directory
ls	List directory
echo 'contents' > <file>	Write contents to a file
cat <file>	Output contents of file

i	In Command Mode	Change into Insert Mode, you can now insert and edit text in the file
esc	In Insert Mode	Change into Command Mode, you can now execute commands
:wq	In Command Mode	Save and Exit

Welcome!

Docker Security - Configure Docker Content Trust

Congratulations!

You've completed the scenario!

Scenario Rating

Steps