如何验证Docker基础镜像的真实性与完整性？

Great question—verifying the authenticity and integrity of Docker base images is a fundamental part of securing your containerized workflows, especially for widely used tags like ubuntu:latest. Let’s break down the key methods to ensure your images are both from trusted sources and unmodified.

1. Docker Content Trust (DCT): Official Authenticity + Integrity Check #

Docker Content Trust is the built-in way to verify that images are signed by their trusted publishers (like Canonical for Ubuntu images). Here’s how to use it:

• Enable DCT: Run this command in your terminal to turn on trust enforcement:

  export DOCKER_CONTENT_TRUST=1
  

  Once enabled, Docker will only pull images that have valid signatures. If you try to pull an unsigned or tampered image, it’ll throw an error immediately.

• Verify existing images: To check if a local image has a valid signature, use:

  docker trust inspect --pretty ubuntu:latest
  

  This will show you the signer information and confirm if the image’s signature matches the publisher’s key.

2. Check Image Digests for Integrity #

Every Docker image has a unique digest (a SHA-256 hash) that represents its exact content. If even a single byte changes, the digest changes too. Here’s how to verify it:

• Get the official digest: For official images like ubuntu:latest, you can find the digest on the Docker Hub page for the image (look under the "Tags" tab for the full digest string).

• Compare with your local image: Run this command to get the digest of your local ubuntu:latest image:

  docker inspect ubuntu:latest | grep -A 1 "Digest"
  

  Or to see the full image ID (which is based on the digest) without truncation:

  docker images --no-trunc ubuntu:latest
  

  Match this digest/ID against the one listed on Docker Hub. If they’re identical, the image hasn’t been corrupted or modified.

3. Ubuntu-Specific Verification Steps #

Since you mentioned ubuntu:latest, Canonical provides extra ways to validate their official images:

• Use Skopeo for detailed inspection: Skopeo is a tool that lets you inspect remote images without pulling them. Run this to check the signature and digest of the Ubuntu image:

  skopeo inspect docker://ubuntu:latest
  

  Look for the Digest field and the Signatures section to confirm it’s signed by Canonical’s keys.

• Verify file integrity inside the container: For an extra layer of check, you can run a hash check on critical system files inside the container and compare them against Ubuntu’s official package hashes. For example:

  docker run --rm ubuntu:latest sha256sum /bin/bash
  

  You can cross-reference this hash with the one from Ubuntu’s package repository for the bash package in the corresponding Ubuntu release.

4. Best Practices to Stay Secure #

• Always pull from official repositories: Stick to docker.io/library/ubuntu (the default Ubuntu repo) instead of third-party mirrors unless you trust the source completely.
• Avoid latest tags long-term: While ubuntu:latest is convenient, using specific version tags (like ubuntu:22.04) makes verification easier, as latest can point to different versions over time.
• Scan images regularly: Use tools like Trivy or Docker Scout to scan images for unexpected modifications, vulnerabilities, or malicious code alongside your verification steps.

内容的提问来源于stack exchange，提问作者vathan Lal