podman-image-trust (1"")

NAME

podman-trust - Manage container image trust policy

SYNOPSIS

podman image trust set|show [-h|--help] [-j|--json] [--raw] [-f|--pubkeysfile KEY1 [f|--pubkeysfile KEY2,...]] [-t|--type signedBy|accept|reject] REGISTRY[/REPOSITORY]

DESCRIPTION

Manages the trust policy of the host system. Trust policy describes a registry scope (registry and/or repository) that must be signed by public keys. Trust is defined in /etc/containers/policy.json. Trust is enforced when a user attempts to pull an image from a registry.

Trust scope is evaluated by most specific to least specific. In other words, policy may be defined for an entire registry, but refined for a particular repository in that registry. See below for examples.

Trust type provides a way to whitelist ("accept") or blacklist ("reject") registries.

Trust may be updated using the command podman image trust set for an existing trust scope.

OPTIONS

-h --help
  Print usage statement.

-f --pubkeysfile
  A path to an exported public key on the local system. Key paths
  will be referenced in policy.json. Any path may be used but path
  /etc/pki/containers is recommended. Option may be used multiple times to
  require an image be sigend by multiple keys. One of --pubkeys or
  --pubkeysfile is required for signedBy type.

-t --type
  The trust type for this policy entry. Accepted values:
    signedBy (default): Require signatures with corresponding list of
                        public keys
    accept: do not require any signatures for this
            registry scope
    reject: do not accept images for this registry scope

show OPTIONS

--raw
  Output trust policy file as raw JSON

-j --json
  Output trust as JSON for machine parsing

EXAMPLES

Accept all unsigned images from a registry

    podman image trust set --type accept docker.io

Modify default trust policy

    podman image trust set -t reject default

Display system trust policy

    podman image trust show

Display trust policy file

    podman image trust show --raw

Display trust as JSON

    podman image trust show --json

HISTORY

December 2018, originally compiled by Qi Wang (qiwan at redhat dot com)