NAME

       podman-image-trust - Manage container registry image trust policy

SYNOPSIS

       podman image trust set|show [options] registry[/repository]

DESCRIPTION

       Manages  which  registries you trust as a source of container images  based on its location. (This option
       is not available with the remote Podman client)

       The location is determined by the transport and the registry host of the  image.   Using  this  container
       image  docker://docker.io/library/busybox  as  an  example,  docker is the transport and docker.io is the
       registry host.

       Trust is defined in /etc/containers/policy.json and is enforced when a user attempts  to  pull  a  remote
       image  from  a  registry.   The  trust  policy in policy.json describes a registry scope (registry and/or
       repository) for the trust.  This trust can use public keys for signed images.

       The scope of the trust is evaluated from most specific to the least specific. In other  words,  a  policy
       may  be  defined  for  an  entire  registry.   Or it could be defined for a particular repository in that
       registry. Or it could be defined down to a specific signed image inside of the registry.

       For example, the following list includes valid scope values that could be used in policy.json  from  most
       specific to the least specific:

       docker.io/library/busybox:notlatest docker.io/library/busybox docker.io/library docker.io

       If  no  configuration  is  found for any of these scopes, the default value (specified by using "default"
       instead of REGISTRY[/REPOSITORY]) is used.

       Trust type provides a way to:

       Allowlist ("accept") or Denylist ("reject") registries or Require signature (“signedBy”).

       Trust may be updated using the command podman image trust set for an existing trust scope.

OPTIONS

   --help, -h
       Print usage statement.

   --pubkeysfile=KEY1, -f
       A path to an exported public key on the local system. Key paths
         will be referenced in policy.json.  Any  path  to  a  file  may  be  used  but  locating  the  file  in
       /etc/pki/containers is recommended. Options may be used multiple times to
         require  an  image  be  signed by multiple keys.  The --pubkeysfile option is required for the signedBy
       type.

   --type=value, -t
       The trust type for this policy entry.
         Accepted values:
           signedBy (default): Require signatures with corresponding list of
                               public keys
           accept: do not require any signatures for this
                   registry scope
           reject: do not accept images for this registry scope

show OPTIONS

   --raw
       Output trust policy file as raw JSON

   --json, -j
       Output trust as JSON for machine parsing

EXAMPLES

       Accept all unsigned images from a registry

              sudo podman image trust set --type accept docker.io

       Modify default trust policy

              sudo podman image trust set -t reject default

       Display system trust policy

              sudo podman image trust show

       Display trust policy file

       sudo podman image trust show --raw

       Display trust as JSON

       sudo podman image trust show --json

SEE ALSO

       containers-policy.json(5)

HISTORY

       January 2019, updated by Tom Sweeney (tsweeney at redhat dot com) December 2018, originally  compiled  by
       Qi Wang (qiwan at redhat dot com)

                                                                                         podman-image-trust(1)()