Answers: <p><a href="https://docs.docker.com/engine/security/trust/trust_delegation/" rel="nofollow noreferrer">This documentation</a> indicates that it is possible to add collaborators by trusting their key and that it is also possible to revoke access.</p>
  
  <p>Having said that, the answer to:</p>
  
  <blockquote>
    <p>either an image is signed or it is not, but it is not qualified by who
    performed the signing</p>
  </blockquote>
  
  <p>that it is possible to check who signed the image if every collaborator creates their own key and each key is trusted individually.</p>
  
  <p>As notary and dtr were already mentioned, an alternative is <a href="http://port.us.org/" rel="nofollow noreferrer">Portus</a>. Portus is able to restrict access to docker images, e.g. some users are only allowed to view images, while others may pull them. It is possible to revoke access as well.</p>
  
Answers: CC BY-SA 3.0
Answers: 2017-09-04T13:00:56.483Z
Answers: 2017-09-04T13:20:34.067Z
Answers: 2017-09-04T13:20:34.067Z
Answers: 030
Body: <p>With respect to <a href="https://docs.docker.com/engine/security/trust/trust_key_mng/" rel="nofollow noreferrer">docker's security system</a>.</p>
  
  <p>Is it possible to somehow get images signed by some entity that has trust from a company's CA-cert and then be able to find out who signed the image?</p>
  
  <p>It seems like <a href="https://docs.docker.com/datacenter/dtr/2.2/guides/" rel="nofollow noreferrer">Docker Trusted Registry (DTR)</a>, and <a href="https://docs.docker.com/notary/getting_started/" rel="nofollow noreferrer">Notary</a> in general, have a binary mode of trust: either an image is signed or it is not, but it is not qualified by who performed the signing.</p>
  
Tags: <docker><security>
Title: Docker Sign an Image with an existing Certificate
UserDisplayName: Nyarmith
ThreadText: # Docker Sign an Image with an existing Certificate
  
  (Asked by: username_0 on 2017-08-29)
  
  With respect to [docker's security system](https://docs.docker.com/engine/security/trust/trust_key_mng/).
  
  Is it possible to somehow get images signed by some entity that has trust from a company's CA-cert and then be able to find out who signed the image?
  
  It seems like [Docker Trusted Registry (DTR)](https://docs.docker.com/datacenter/dtr/2.2/guides/), and [Notary](https://docs.docker.com/notary/getting_started/) in general, have a binary mode of trust: either an image is signed or it is not, but it is not qualified by who performed the signing.
  
  **Tags:** docker, security
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2017-09-04. Score: 1
  
  [This documentation](https://docs.docker.com/engine/security/trust/trust_delegation/) indicates that it is possible to add collaborators by trusting their key and that it is also possible to revoke access.
  
  Having said that, the answer to:
  
  > either an image is signed or it is not, but it is not qualified by who
  > performed the signing
  
  that it is possible to check who signed the image if every collaborator creates their own key and each key is trusted individually.
  
  As notary and dtr were already mentioned, an alternative is [Portus](http://port.us.org/). Portus is able to restrict access to docker images, e.g. some users are only allowed to view images, while others may pull them. It is possible to revoke access as well.
  
  
  ---
  
  