github.com/containers/podman/v2@v2.2.2-0.20210501105131-c1e07d070c4c/docs/source/markdown/podman-image-trust.1.md (about)

     1  % podman-image-trust(1)
     2  
     3  ## NAME
     4  podman\-image\-trust - Manage container registry image trust policy
     5  
     6  
     7  ## SYNOPSIS
     8  **podman image trust** set|show [*options*] *registry[/repository]*
     9  
    10  ## DESCRIPTION
    11  Manages which registries you trust as a source of container images  based on its location. (Not available for remote commands)
    12  
    13  The location is determined
    14  by the transport and the registry host of the image.  Using this container image `docker://docker.io/library/busybox`
    15  as an example, `docker` is the transport and `docker.io` is the registry host.
    16  
    17  Trust is defined in **/etc/containers/policy.json** and is enforced when a user attempts to pull
    18  a remote image from a registry.  The trust policy in policy.json describes a registry scope (registry and/or repository) for the trust.  This trust can use public keys for signed images.
    19  
    20  The scope of the trust is evaluated from most specific to the least specific. In other words, a policy may be defined for an entire registry.  Or it could be defined for a particular repository in that registry. Or it could be defined down to a specific signed image inside of the registry.
    21  
    22  For example, the following list includes valid scope values that could be used in policy.json from most specific to the least specific:
    23  
    24  docker.io/library/busybox:notlatest
    25  docker.io/library/busybox
    26  docker.io/library
    27  docker.io
    28  
    29  If no configuration is found for any of these scopes, the default value (specified by using "default" instead of REGISTRY[/REPOSITORY]) is used.
    30  
    31  Trust **type** provides a way to:
    32  
    33  Allowlist ("accept") or
    34  Denylist ("reject") registries or
    35  Require signature (“signedBy”).
    36  
    37  Trust may be updated using the command **podman image trust set** for an existing trust scope.
    38  
    39  ## OPTIONS
    40  #### **--help**, **-h**
    41    Print usage statement.
    42  
    43  #### **--pubkeysfile**=*KEY1*, **-f**
    44    A path to an exported public key on the local system. Key paths
    45    will be referenced in policy.json. Any path to a file may be used but locating the file in **/etc/pki/containers** is recommended. Options may be used multiple times to
    46    require an image be signed by multiple keys.  The **--pubkeysfile** option is required for the **signedBy** type.
    47  
    48  #### **--type**=*value*, **-t**
    49    The trust type for this policy entry.
    50    Accepted values:
    51      **signedBy** (default): Require signatures with corresponding list of
    52                          public keys
    53      **accept**: do not require any signatures for this
    54              registry scope
    55      **reject**: do not accept images for this registry scope
    56  
    57  ## show OPTIONS
    58  
    59  #### **--raw**
    60    Output trust policy file as raw JSON
    61  
    62  #### **--json**, **-j**
    63    Output trust as JSON for machine parsing
    64  
    65  ## EXAMPLES
    66  
    67  Accept all unsigned images from a registry
    68  
    69      sudo podman image trust set --type accept docker.io
    70  
    71  Modify default trust policy
    72  
    73      sudo podman image trust set -t reject default
    74  
    75  Display system trust policy
    76  
    77      sudo podman image trust show
    78  
    79  Display trust policy file
    80  
    81     sudo podman image trust show --raw
    82  
    83  Display trust as JSON
    84  
    85     sudo podman image trust show --json
    86  
    87  ## SEE ALSO
    88  
    89  containers-policy.json(5)
    90  
    91  ## HISTORY
    92  January 2019, updated by Tom Sweeney (tsweeney at redhat dot com)
    93  December 2018, originally compiled by Qi Wang (qiwan at redhat dot com)