Signing and Verifying Docker Images

Just as we can make sure that the applications we purchase and install on our systems are from a trusted source, we can do the same with the Docker images we use. Running an untrusted Docker image could become a huge risk and could cause major issues in our system. This is why we should look to have specific proof of the images we are using. An untrusted source could potentially add code to the running image, which could expose your entire network to the attacker.

Fortunately, Docker has a way of digitally signing our images to ensure we're using images from a verified vendor or provider. This will also ensure the image has not been changed or corrupted since it was originally signed, ensuring some authenticity. It shouldn't be the only way we trust our images. As you'll see later in this chapter, once we have our image, we can then scan it to ensure we avoid installing an image that may have security issues.

The way that Docker...