Container Registry Docker content trust is not enabled

July 2, 2025 · View on GitHub

SYNOPSIS

Docker content trust allows images to be signed and verified when pulled from a container registry.

DEPRECATION

DESCRIPTION

Azure Container Registry (ACR) content trust enables pushing and pulling of signed images. Signed images provides additional assurance that they have been built on a trusted source.

To enable content trust, the container registry must be using a Premium SKU.

Content trust is currently not supported in a registry that's encrypted with a customer-managed key. When using customer-managed keys, content trust can not be enabled.

RECOMMENDATION

Consider enabling content trust on registries, clients, and sign container images.

EXAMPLES

Configure with Azure template

To deploy registries that pass this rule:

Set properties.trustPolicy.status to enabled.
Set properties.trustPolicy.type to Notary.

For example:

{
  "type": "Microsoft.ContainerRegistry/registries",
  "apiVersion": "2023-08-01-preview",
  "name": "[parameters('name')]",
  "location": "[parameters('location')]",
  "sku": {
    "name": "Premium"
  },
  "identity": {
    "type": "SystemAssigned"
  },
  "properties": {
    "adminUserEnabled": false,
    "policies": {
      "trustPolicy": {
        "status": "enabled",
        "type": "Notary"
      },
      "retentionPolicy": {
        "days": 30,
        "status": "enabled"
      }
    }
  }
}

Configure with Bicep

To deploy registries that pass this rule:

Set properties.trustPolicy.status to enabled.
Set properties.trustPolicy.type to Notary.

For example:

resource registry 'Microsoft.ContainerRegistry/registries@2023-08-01-preview' = {
  name: name
  location: location
  sku: {
    name: 'Premium'
  }
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    adminUserEnabled: false
    policies: {
      trustPolicy: {
        status: 'enabled'
        type: 'Notary'
      }
      retentionPolicy: {
        days: 30
        status: 'enabled'
      }
    }
  }
}