Hacker News Reader

Can anyone from Docker speak to the status of content trust? The fact that I can still `docker pull whatever` without explicitly trusting the source seems to conflict with the chart in this post. Will/shouldn't content trust be turned on by default at some point?

View on HN

Yes that is the plan, once everything is in place. The next step is to turn it on for official images (which are all signed now).

To add to Justin's comment, we merged what we've called "trust pinning" into Notary. We're still iterating on exactly the right scopes to pin to, but anticipate that making it into docker in the not too distant future. That will enable you to hard fail when pulling images not signed by an explicitly approved source.

Reply on news.ycombinator.com