Answers: <p>At first glance, it seems that tag immutability is not a feature provided by Quay. You can enable &quot;Trust and Signing&quot; in the &quot;settings&quot; of the repo:</p>
  <blockquote>
  <p>Please note that this will not prevent users from overwriting signed tags without updating signatures. This means that:</p>
  <ul>
  <li>Any tag operations in the UI or client can cause inconsistency</li>
  <li>Builds should not push to signed tags</li>
  </ul>
  <p>We recommend you maintain a strict separation between signed and unsigned tags to avoid any issues with garbage collection.</p>
  </blockquote>
  <p>So, you can sign tags, but you can't prevent them from being updated.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-11-06T11:15:45.033Z
Answers: 2019-11-06T11:15:45.033Z
Answers: 2020-06-18T08:28:10.803Z
Answers: Bruce Becker
Body: <p>Elastic Container Registry (ECR) for example supports Tag Immutability (TI). TI implies that docker tags cannot be overwritten if they exist in a docker-registry.</p>
  
  <p>The settings of the organization and the ones from a repository were inspected, but no TI setting was found.</p>
  
  <p><strong>Questions</strong></p>
  
  <ul>
  <li>Does quay support TI?</li>
  <li>If true, how to enable it</li>
  <li>If false, how do you or does your organization prevent that tag overwrite takes place?</li>
  </ul>
  
Tags: <docker><docker-registry><quay.io><dip>
Title: How to enable tag immutability in quay.io?
UserDisplayName: 030
ThreadText: # How to enable tag immutability in quay.io?
  
  (Asked by: username_0 on 2019-11-06)
  
  Elastic Container Registry (ECR) for example supports Tag Immutability (TI). TI implies that docker tags cannot be overwritten if they exist in a docker-registry.
  
  The settings of the organization and the ones from a repository were inspected, but no TI setting was found.
  
  **Questions**
  
  * Does quay support TI?
  * If true, how to enable it
  * If false, how do you or does your organization prevent that tag overwrite takes place?
  
  **Tags:** docker, docker-registry, quay.io, dip
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2019-11-06. Score: 3 | Accepted answer
  
  At first glance, it seems that tag immutability is not a feature provided by Quay. You can enable "Trust and Signing" in the "settings" of the repo:
  
  > Please note that this will not prevent users from overwriting signed tags without updating signatures. This means that:
  >
  > * Any tag operations in the UI or client can cause inconsistency
  > * Builds should not push to signed tags
  >
  > We recommend you maintain a strict separation between signed and unsigned tags to avoid any issues with garbage collection.
  
  So, you can sign tags, but you can't prevent them from being updated.
  
  
  ---
  
  