Docker's documentation says Docker Content Trust is being retired and the service is no longer reliable for pulls, and it recommends planning a move to another signing solution such as Sigstore or Notation. If your pulls fail with the trust variable set, unset it, then replace it with digest pinning, signature verification and provenance checks.
What the docs say
Two Docker pages mention it. The trusted content page says that if pulls fail and DOCKER_CONTENT_TRUST is set to 1, you should unset it, noting that Docker Content Trust is being retired and the service is no longer reliable for pulls. The Docker Official Images page says Docker is retiring Docker Content Trust for these images and recommends planning a move to a different signing solution, such as Sigstore or Notation.
First, stop the breakage
- Search your CI settings, shell profiles, Dockerfiles and Compose files for DOCKER_CONTENT_TRUST.
- Where pulls fail, unset it, as the docs advise.
- Record that you did this, because it removes a check you may have relied on, and you now need a replacement.
What to replace it with
Content Trust was meant to give you assurance about who published an image and that it was unchanged. You can rebuild that assurance from parts.
| Goal | Replacement |
|---|---|
| Content unchanged between check and run | Pin images by digest |
| Publisher signed it | Verify a signature with a tool such as cosign or Notation, using an identity you were told to expect |
| Know how it was built | Read provenance attestations when the publisher ships them |
| Know what is inside | Scan the digest and keep an SBOM |
| Only approved sources | Registry allowlist and CI checks on image references |
A practical path
Start with the cheapest step. Pinning digests costs little and removes drift. Next, add a scan on adoption. Then, for the few images that matter most, ask the publisher what identity signs their images and add verification to your pipeline.
For images that do not ship signatures, compensate with stricter runtime limits and more frequent re-scans.
A caution about wording
Do not tell a customer or auditor you verify image signatures if you only set a flag that no longer works. Describe what you do today: for example, "we pin digests and scan every image before use." Update the statement when the new signature step is in place.
Questions to ask each publisher
- How are your images signed, and with which tool?
- What identity or key should I expect?
- Do you ship provenance and an SBOM?
- How will you announce a key or identity change?
Keep the answers in your supplier records. They save time at the next security review.
Quick check
What should I do if pulls fail with Content Trust enabled?
Docker's docs say to unset DOCKER_CONTENT_TRUST, then replace the lost check with digests, signature verification and scanning.
Which tools does Docker point to as alternatives?
The official images page names Sigstore and Notation as examples of other signing solutions.
Safeguard's policies and gates can enforce your replacement checks in CI, and dependency scanning plus SBOM show what is inside each image. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
