Docker注册表锁定及非签名镜像拦截技术咨询

Great questions—super relevant for regulated, high-stakes environments like banking where supply chain security and configuration control are non-negotiable. Let’s break down solutions tailored to your setup with Docker EE:

1. Lock Docker Registry URL to Trusted Internal Address & Block Manual Modifications #

Absolutely—this is totally doable with Docker EE's centralized management tools plus some OS-level guardrails:

• Use UCP (Universal Control Plane) Node Policies:
  • Create a node pool policy that overrides the Docker daemon's registry configuration, setting your internal Registry as the only allowed mirror/registry. This pushes the config to all managed developer machines automatically, and prevents local tweaks since UCP enforces the policy on every sync.
• Lock the Daemon Config File:
  • On individual nodes, hardcode your internal Registry in /etc/docker/daemon.json (Linux) or C:\ProgramData\docker\config\daemon.json (Windows) using the registry-mirrors key:

    {
      "registry-mirrors": ["https://your-internal-registry.example.com"]
    }
    

  • Restrict write permissions to this file via OS controls (e.g., chmod 644 and set ownership to root on Linux, or use Windows Group Policy to deny write access). This stops developers from editing the config manually.
• Block External Registry Access:
  • Layer on network firewalls or UCP network policies to block outbound traffic to public registries like Docker Hub, forcing all image pulls to go through your trusted internal registry.

2. Block Running Unsigned or Non-Specified Certificate-Signed Images #

You’re spot-on—Docker EE (now part of Mirantis Container Runtime) has native features to enforce this strict image validation:

• Enable Docker Content Trust (DCT):
  • Set the DOCKER_CONTENT_TRUST=1 environment variable globally on all developer machines (via OS startup scripts or UCP node policies). This forces Docker to only pull images that are signed with a trusted key.
• Enforce Signature Verification via UCP Policies:
  • In UCP, create an image access policy that requires all images to be signed by your internal CA or pre-approved trusted keys. You can tie this policy exclusively to your internal Registry, so any image from outside or without a valid signature gets blocked automatically.
• Configure Trusted Root Certificates:
  • Push your internal CA's root certificate to all Docker nodes (via UCP's node configuration or OS-level certificate stores) so Docker recognizes signatures from your approved signing keys as valid.

Content of the question comes from Stack Exchange, asked by Bryon