#image-signing
Tagged “image-signing”
2 articlesSupply chain security
Unsigned images meet an autonomous puller. What could go wrong.
The New Stack argues unsigned container images have always been a risk and become a bigger one when the puller is an AI agent with no human in the loop. The fix, image signing, has been on the shelf for years.
Aug 16, 2026 · Tomás VegaSecurity & supply chainDocker Content Trust gets a sunset date. The harder question is what you sign with next.
Docker has published a formal retirement plan for Docker Content Trust and the Notary v1 service at notary.docker.io, ten years after DCT shipped. The migration is mostly mechanical, the strategic question, about whether anyone downstream was actually verifying anything, is the part the guide cannot answer for you.
Jun 16, 2026 · Tomás Vega