# Docker Content Trust/container signing enforcement

**URL:** <https://forums.balena.io/t/docker-content-trust-container-signing-enforcement/5860>\
**Category:** balenaEngine\
**Tags:** security\
**Created:** [April 2, 2019, 9:50pm UTC](https://forums.balena.io/t/docker-content-trust-container-signing-enforcement/5860 "2019-04-02T21:50:58Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![moosnat-meraki](https://avatars.discourse-cdn.com/v4/letter/m/e9a140/32.png) [@moosnat-meraki](https://forums.balena.io/u/moosnat-meraki)\
**Post date:** [April 2, 2019, 9:50pm UTC](https://forums.balena.io/t/docker-content-trust-container-signing-enforcement/5860/1 "2019-04-02T21:50:58Z")

</div>

Hi, I’m currently experimenting with using balenaEngine in an edge product. One of our requirements is that we enforce container image signing and refuse to run untrusted images. Does balenaEngine support Docker Content Trust enforcement, like the upstream Docker engine does?

---

<div class="post-metadata">

**Author:** ![robertgzr](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/robertgzr/32/1387_2.png) [@robertgzr](https://forums.balena.io/u/robertgzr)\
**Post date:** [April 4, 2019, 10:50am UTC](https://forums.balena.io/t/docker-content-trust-container-signing-enforcement/5860/7 "2019-04-04T10:50:05Z")

</div>

Hi @moosnat-meraki

you should be able to follow the official docker docs on the `trust` subcommand: [docker trust | Docker Docs](https://docs.docker.com/v17.12/edge/engine/reference/commandline/trust/)

> This command is experimental on the Docker client. It should not be used in production environments. To enable experimental features in the Docker CLI, edit the [config.json](https://docs.docker.com/v17.12/engine/reference/commandline/cli/#configuration-files) and set `experimental` to `enabled` .

---

<div class="post-metadata">

**Author:** ![moosnat-meraki](https://avatars.discourse-cdn.com/v4/letter/m/e9a140/32.png) [@moosnat-meraki](https://forums.balena.io/u/moosnat-meraki)\
**Post date:** [April 4, 2019, 11:45pm UTC](https://forums.balena.io/t/docker-content-trust-container-signing-enforcement/5860/8 "2019-04-04T23:45:41Z")

</div>

Hey, thanks!  
Related question: can I configure balenaEngine to only accept containers from one remote registry (and configure that registry as default)?

---

<div class="post-metadata">

**Author:** ![sdh](https://avatars.discourse-cdn.com/v4/letter/s/e9c0ed/32.png) [@sdh](https://forums.balena.io/u/sdh)\
**Post date:** [September 9, 2021, 7:34pm UTC](https://forums.balena.io/t/docker-content-trust-container-signing-enforcement/5860/11 "2021-09-09T19:34:02Z")

</div>

Any updates here? I see how we can sign dockers but not how we can enforce them.

I looked through the code & issues on [https://github.com/balena-os/balena-engine](https://github.com/balena-os/balena-engine) and didn’t see anything obvious that suggests this is supported.

Complying with NIST Cyber Security guidelines for IoT requires authenticated updates.

---

<div class="post-metadata">

**Author:** ![robertgzr](https://sea2.discourse-cdn.com/balena/user_avatar/forums.balena.io/robertgzr/32/1387_2.png) [@robertgzr](https://forums.balena.io/u/robertgzr)\
**Post date:** [October 25, 2021, 10:06am UTC](https://forums.balena.io/t/docker-content-trust-container-signing-enforcement/5860/13 "2021-10-25T10:06:00Z")

</div>

Hi, you are correct, we currently don’t have any support on the balena-cloud/device -side to enforce signed images. I am following the development of [notary v2](https://github.com/notaryproject/notaryproject/blob/main/status-updates/notary-status-2021-02.md) to keep on top of things there, since we do have some plans to integrate this eventually.

To get a better picture of your requirements, I assume you need both OS and application updates to be signed?