

While the surrounding partner ecosystem works to fill its manageability gaps, Docker Inc. is trying to tackle the other major challenge facing its namesake containerization engine with the addition of a new security feature meant to address the lack of native workload protections. It’s an expansion of the digital signing functionality rolled out for the tool ten months ago.
Developers have since been able to verify software they upload to the Docker Hub Registry, the official repository for containerized applications, with a special cryptographic key that serves the same purpose as a wax seal on an envelope. The new functionality introduced this morning allows enterprises to take advantage of the signatures in their security workflows to automate the vetting process.
Docker can now be configured to check for a key not only when a developer downloads a project from the Docker Hub Registry but also upon the initial launch of the application and before every update afterwards. That extends the usefulness of the augmented verification functionality beyond the pre-packaged components that can be downloaded online to internal development projects.
The small but rapidly growing number of organizations using Docker in production are exploiting the light and portable nature of containers to facilitate so-called rapid integration projects wherein upwards of dozens of updates are rolled out to the live environment every day. Having the tool automatically check for keys between handoffs provides a much more convenient alternative to manual verification, not to mention a more reliable one.
But the main improvement of Docker Content Trust, as the new security function is known, lies on the other end of the certification equation where the signing is performed. The setup used before has been replaced with asymmetric encryption based on The Update Framework standard that assigns each repository a so-called root key from which the cyphers of the individual applications within are generated.
That arrangement allows users to store the root key in a separate location in order to make it harder for hackers to compromise their projects. Particularly security-conscious organizations can go a step further and periodically refresh the application keys, or, if the workload in question is especially sensitive, use a timestamped cypher. That prevents the possibility of a hacker tricking a developer into downloading a dated version of a project with unpatched vulnerability.
The added protection afforded through Docker Hub Registry should prove a boon for both large organizations running private container clusters and individual developers who rely on images from the Docker Hub Registry to build their applications. It’s available for download immediately.
THANK YOU