Summary

Add support for trusted image distribution through the use of notary. Notary logic is done client side to allow cli users full configuration of trust and limiting access to private keys to user's machine. Trusted cli actions which involve pulling will always do a pull by digest to the daemon. Since the daemon already supports pull by digest, no changes to the daemon are needed to support the use of notary. All signatures will be done directly from the client on push. For more details on the design, see the design document.

UX Changes

Flags

• --untrusted - Explicitly run a pull or push action as untrusted. Defaults to true in 1.7. This can be used to override the DOCKER_NOTARY environment variable.

Trusted Mode

Pull Changes

Pull by digest

The initial pull line will now always include the digest of the image being pulled.

Sequential pull all

When pulling multiple tags, the client will now sequentially call a pull by digest on every tag.

Full sample pull output

Expanded name to docker.io/dmcgowan/myapp
Pull (1 of 1): dmcgowan/myapp:latest@sha256:8d62273b15d0dd7726e5dd7e27b5a1c8bff2106557caccfa5e2f1ba6956556c8
sha256:8d62273b15d0dd7726e5dd7e27b5a1c8bff2106557caccfa5e2f1ba6956556c8: Pulling from dmcgowan/myapp
a8219747be10: Already exists 
91c95931e552: Already exists 
Digest: sha256:8d62273b15d0dd7726e5dd7e27b5a1c8bff2106557caccfa5e2f1ba6956556c8
Status: Downloaded newer image for dmcgowan/myapp@sha256:8d62273b15d0dd7726e5dd7e27b5a1c8bff2106557caccfa5e2f1ba6956556c8
Tagging dmcgowan/myapp@sha256:8d62273b15d0dd7726e5dd7e27b5a1c8bff2106557caccfa5e2f1ba6956556c8 as dmcgowan/myapp:latest

Push Changes

Status Line

Push status line which displays digest now shows tag, digest, and size. This was used for client to be able to parse from the output what the pushed manifests were. These output lines represent the changes which will be made to the notary repository.

old

Digest: sha256:f2ee4bbffcce22f295f8c9a987dcc55f0987b339bf8fc0277e52560563e5c118

new

latest: digest: sha256:f2ee4bbffcce22f295f8c9a987dcc55f0987b339bf8fc0277e52560563e5c118 size: 10115

Passphrase prompt on first push of repository

When a repository is pushed for the first time the cli will be prompted for a passphrase. The passphrase will not be echoed back to the user. If metadata is near expiration time, the passphrase may be prompted again to re-sign the metadata. Subsequent pushes should not require entering a passphrase. If entering in a passphrase is not desirable, then the notary tool may be used directly to initialize a repository.

Full sample push output

The push refers to a repository [dmcgowan/myapp] (len: 1)
91c95931e552: Image already exists 
a8219747be10: Image already exists 
latest: digest: sha256:f2ee4bbffcce22f295f8c9a987dcc55f0987b339bf8fc0277e52560563e5c118 size: 10115
Signing and pushing TUF metadata
Expanded name to docker.io/dmcgowan/myapp
Loading trusted collection.
Creating a new private key
Passphrase:
Saving changes to Trusted Collection.
Finished initializing "docker.io/dmcgowan/myapp"
Loading trusted collection.

Environment Variables

• DOCKER_NOTARY - boolean whether to use Notary in Docker
• NOTARY_SERVER - Notary server to use for all repositories

Remaining items for code review

• Authentication integration with distribution client (need to solve problem with FQDN support)
• Load Certificates from ~/.docker/tls/