{"id":1373,"date":"2016-09-13T14:25:01","date_gmt":"2016-09-13T12:25:01","guid":{"rendered":"https:\/\/blog.mi.hdm-stuttgart.de\/?p=1373"},"modified":"2023-08-06T21:53:55","modified_gmt":"2023-08-06T19:53:55","slug":"exploring-docker-security-part-3-docker-content-trust","status":"publish","type":"post","link":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/2016\/09\/13\/exploring-docker-security-part-3-docker-content-trust\/","title":{"rendered":"Exploring Docker Security – Part 3: Docker Content Trust"},"content":{"rendered":"
https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2023\/08\/Notary.jpg<\/figcaption><\/figure>\n

In terms of security, obtaining Docker images from private or public Docker Registries is affected by the same issues as every software update system: It must be ensured that a client can always verify the publisher of the content and also that he or she actually got the latest version of the image. In order to provide its users with that guarantees, Docker ships with a feature called Docker Content Trust<\/em> since version 1.8.
\nThis third and last part of this series intends to give an overview of Docker Content Trust, which in fact combines different frameworks and tools, namely Notary <\/em>and Docker Registry v2<\/em>,  into a rich and powerful feature set making Docker images more secure.<\/p>\n

<\/p>\n

The software update process<\/h2>\n

First of all, I want to make sure that we have a common understanding of how software update systems generally do their job. It doesn’t really matter if we think package managers like APT<\/em><\/a>  or  software library managers like RubyGems<\/a>, since their core functionality is basically the same. So let’s briefly skim through the steps such an update system performs to check and – if necessary – install the latest updates:<\/p>\n

    \n
  1. The updating process starts with a download of metadata files from the a certain repository. These files list the latest version(s) of the software hosted by this repository.<\/li>\n
  2. The client’s update system investigates the previously fetched metadata files and checks if there’s any software available which is newer than what is currently installed on the client machine.<\/li>\n
  3. In case there’s new software available, the software update system downloads and installs the latest version(s) of the package(s) or application(s).<\/li>\n
  4. In case the client is already in posession of the latest software, nothing happens.<\/li>\n<\/ol>\n

     <\/p>\n

    Conceivable attacks on software update systems<\/h2>\n

    Now that we clarified how software update systems operate in high-level terms, I want to convey a first picture of why securing the software update process is so important. There’ re many different kinds of attacks a client might be exposed to, so let’s take a moment and review some of them:<\/p>\n