This repository contains the public signing keys for Docker Hardened Images. These keys are used to verify the authenticity and integrity of Docker Hardened Images and their attestations.
The keyring provides cryptographic verification for Docker Hardened Images, ensuring:
- Supply chain security: Verify image signatures and provenance
- Attestation validation: Confirm authenticity of SBOMs and VEX metadata
- Trust: Ensure images haven't been tampered with
To verify images and attestations, you can run the following commands:
# log into dhi.io
$ docker login dhi.io
# verify the signature on the image index
$ cosign verify dhi.io/alpine-base:3.22 \
--key https://dhi.io/keyring/latest.pub \
--experimental-oci11# list all available attestations
$ regctl artifact list dhi.io/golang:1-debian12-dev \
--platform linux/arm64
# verify the signature on any of the provided attestations
$ cosign verify dhi.io/golang@sha256:... \
--key https://dhi.io/keyring/latest.pub \
--experimental-oci11$ cd /etc/apk/keys && curl -O https://dhi.io/keyring/dhi-apk@docker-0F81AD7700D99184.rsa.pub
$ echo "https://dhi.io/apk/alpine/v3.23/main" >> /etc/apk/repositories
$ apk update$ cd /etc/apk/keys && curl -O https://dhi.io/keyring/dhi-apk-sec@docker-0F81AD7700D99184.rsa.pub
$ echo "https://dhi.io/apk/alpine/v3.23/security" >> /etc/apk/repositories
$ apk update$ cd /etc/apk/keys && curl -O https://dhi.io/keyring/dhi-apk-els@docker-0F81AD7700D99184.rsa.pub
$ echo "https://dhi.io/apk/alpine/v3.23/els" >> /etc/apk/repositories
$ apk updateThe Enterprise and ELS package repositories require authentication and DHI entitlements.
You can authenticate using the dhictl by running the following command:
$ docker run -it -e HTTP_AUTH="$(dhictl auth apk)" dhi.io/alpine-base:3.23-dev$ curl -s https://dhi.io/keyring/dhi-deb-gpg.D46852F6925E9F71.key | gpg --dearmor >> /usr/share/keyrings/docker-dhi-deb.gpg
$ echo "deb [signed-by=/usr/share/keyrings/docker-dhi-deb.gpg] https://dhi.io/deb/debian trixie main" >> /etc/apt/sources.list.d/docker-dhi.list
$ echo "deb-src [signed-by=/usr/share/keyrings/docker-dhi-deb.gpg] https://dhi.io/deb/debian trixie main" >> /etc/apt/sources.list.d/docker-dhi.list
$ apt-get updateThis project is licensed under the Apache License 2.0. See LICENSE.txt for details.
- Docker Hardened Images Catalog: dhi.io
- Docker Hardened Images: docker.com/products/hardened-images
- Catalog Repository: github.com/docker-hardened-images/catalog
- Commercial Support: docker.com/support
- Issue Tracker: GitHub Issues
- Discussions: GitHub Discussions
Docker Hardened Images - Building secure containers, together.