docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added more on verification.

This commit is contained in:
Anne Henmi 2018-10-19 08:09:29 -06:00
parent bcf2835e83
commit 5064765733
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
engine/security/trust/content_trust.md
View File

@ -164,6 +164,15 @@ If translation or verification fails, the request or operation requiring the ima
This can happen because the content trust server is not reachable, if the `allow-expired-trust-cache`
is eanbled, or the the DCT metadata is used if the timestamp has not expired.
DCT checks against metadata, and this will prevent an image verification for happening twice when
using the `docker run` command. The `docker run` command first creates a container and starts it
immediately.
DCT needs to verify the image because a container could have been created before a change to the
Content Trust configuration. As a result, DCT enforces the new configuration by applying it to
the old created container. Alternately, a container could have been created significantly earlier,
which means the trust data for it is no longer valid. In that case, DCT will re-verify the container.
Provided `skip-check-on-run` is not enabled, an initiated container's image will be re-validated
against the cached metadata first. If the cached metadata has expired or is not available, the image
will be validated using the image name, digest, or tag.