Content Trust Not Enabled (CIS 4.5)

​

Impact & Risk Analysis

• Severity: Medium
• CIS Benchmark: CIS 4.5
• Impact: Spoofing & Compromised Provenance. Content trust provides the ability to use digital signatures for data sent to and received from remote Docker registries. Without it, there is no client-side verification of the identity and the publisher of specific image tags, allowing potential spoofing or the use of compromised images.

​

Common Misconfiguration

​

Vulnerable Example

# Vulnerable Environment (Default)
# DOCKER_CONTENT_TRUST is not set.
# The user pulls an image without verifying its provenance.
docker pull postgres:latest

# Vulnerable CI/CD Step
# No trust environment variable is defined.
RUN docker build -t myapp:latest .

​

Secure Example

# Secure Environment
# Enabling Content Trust enforces signature verification.
export DOCKER_CONTENT_TRUST=1

# Now, this command will fail if the image is not signed or the signature is invalid.
docker pull postgres:latest

​

Audit Procedure

echo $DOCKER_CONTENT_TRUST

• Result: This should return a value of 1.
• Fail: If it returns an empty line or 0, Content Trust is disabled.

​

Remediation

export DOCKER_CONTENT_TRUST=1