Need help with other JFrog products?
Configuring Docker Notary and Docker Client
There is no configuration needed in Artifactory in order to work with trusted Docker images. However, in the setup instructions below, we do recommend testing your configuration by signing Artifactory and running it in a container.
To configure the Docker Notary and client to work with Artifactory, execute the following main steps:
- Configure your hosts file
- Configure the Notary server and run it as a container
- Configure the Docker client
Configuring Your Hosts File
If you are not working with a DNS, add the following entries to your
Configuring the Notary Server
Create a directory for your Notary server. In the code snippets below we will use
Create a dockerfile with the following content:
Use a private certificate
This configuration runs with a public certificate. Any Docker client running with the same public certificate may be able to access your Notary server.
For a secure setup, we recommend replacing it with your organization's private certificate by replacing the public
root-ca.crt certificate file
/root/notary/fixtures on your Notary server, and under
/usr/local/share/ca-certificates on the machine running your Docker client.
Build the test image:
If you are running the build in your dockerfile directory, you can just use "." as the path to the dockerfile
Start the Notary server:
To start the Notary server, you first need to have Docker Compose installed.
Then execute the following steps:
Configuring the Docker Client
To connect the Notary server to the Docker client you need to enable the Docker content trust flag and add the Notary server URL as follows:
Test Your Setup
The example below demonstrates setting up the Notary server and Docker client, signing an image and the pushing it to Artifactory, with the following assumptions:
- Artifactory is up and running in a Docker container
- You have configured the Notary server
- Notary server and Artifactory run on localhost (127.0.0.1)
- Notary server is in directory
- Working without a DNS (so we need to configure the hosts file)
- Notary server name is
- Artifactory server name is
- Docker Compose is installed
Set up the IP mappings
Pull an image for testing
After you have pulled the image, you need to
docker login to
Configure the Docker client
Tag the image you pulled for testing and push it to Artifactory
You will be asked to enter the root key passphrase. This will be needed every time you push a new image while the DOCKER_CONTENT_TRUST flag is set.
The root key is generated at:
You will also be asked to enter a new passphrase for the image. This is generated at
/root/.docker/trust/private/tuf_keys/[registry name] /[imagepath]
The Docker image is signed after it is pushed to Artifactory.