--- title: Docker Content Trust: Retirement and Migration Guidance description: Docker Content Trust (DCT) and the Notary v1 service at notary.docker.io are being fully retired by December 8, 2026. Fewer than 0.05% of Docker Hub pulls use... canonical: https://daily.dev/posts/docker-content-trust-retirement-and-migration-guidance-1ldxep4fb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Docker Content Trust: Retirement and Migration Guidance | daily.dev og:description: Docker Content Trust (DCT) and the Notary v1 service at notary.docker.io are being fully retired by December 8, 2026. Fewer than 0.05% of Docker Hub pulls use... og:url: https://daily.dev/posts/docker-content-trust-retirement-and-migration-guidance-1ldxep4fb og:image: https://api.daily.dev/og/posts/1LDXeP4FB.png og:image:alt: Docker Content Trust: Retirement and Migration Guidance og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Docker Content Trust: Retirement and Migration Guidance **[Docker](https://daily.dev/sources/docker)** · 7 min read · 56 upvotes · 2 comments ## Summary Docker Content Trust (DCT) and the Notary v1 service at notary.docker.io are being fully retired by December 8, 2026. Fewer than 0.05% of Docker Hub pulls use DCT, and the upstream Notary v1 codebase is unmaintained. A phased brownout schedule begins July 2026. Users who never enabled DCT are unaffected. Those who did should migrate to modern alternatives: disable the DOCKER_CONTENT_TRUST environment variable, pin images by digest for reproducibility, and adopt Sigstore/Cosign or Notation for cryptographic publisher verification. Kubernetes admission enforcement can be handled via Kyverno (for Cosign) or Ratify+Gatekeeper (for Notation). Docker Hardened Images are also offered as a drop-in replacement with built-in signatures, provenance attestations, and SBOMs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### When is Docker Content Trust (DCT) being fully shut down? Docker Content Trust and the Notary v1 service at notary.docker.io shut down completely on December 8, 2026. Before that, scheduled brownouts test the transition: 4-hour write brownouts on July 14 and 15, 2026, and 4-hour read brownouts on August 10 and 12, 2026, all starting at 8AM Pacific Time. Ordinary docker pull and push keep working throughout. _Teams tracking Docker security deprecations like this follow migration timelines on daily.dev._ ### How do I replace Docker Content Trust for verifying image publisher identity? Use Sigstore/Cosign or Notation, the two actively maintained signing tools that replaced DCT. Cosign supports identity-based signing with short-lived certificates tied to an OIDC identity, while Notation uses a certificate-based PKI model; both store signatures as OCI artifacts alongside the image in any compliant registry, avoiding DCT's separate trust infrastructure. _Developers choosing a container signing tool compare options like Cosign and Notation on daily.dev._ ### What should I do if my DOCKER_CONTENT_TRUST environment variable is set to 1? Unset it or explicitly set DOCKER_CONTENT_TRUST=0 to disable Docker Content Trust and keep image pulls working after the shutdown. Check shell profiles, CI/CD configuration, Compose files, and Kubernetes manifests for the variable, since disabling it removes tag-level verification but is the fastest way to unblock pulls before December 8, 2026. _Engineers untangling deprecated env vars during Docker upgrades track fixes like this on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@deepjoshi\_dev** · 1 upvotes > I wasn't even aware of that. **@akkitto** · 0 upvotes > Funny, just a week ago I did all this already. Good to know, it's still best practice. ## Similar posts on daily.dev - [Signing and verifying container images with Cosign and Sigstore](https://daily.dev/posts/signing-and-verifying-container-images-with-cosign-and-sigstore-py88l4cfh) · Security Boulevard · 0 upvotes · 0 comments - [Making the Most of Your Docker Hardened Images Enterprise Trial – Part 2](https://daily.dev/posts/making-the-most-of-your-docker-hardened-images-enterprise-trial-part-2-67ueaj5ym) · Docker · 0 upvotes · 0 comments - [Container Image Security \(Signing and Scanning with tools like Cosign, Trivy\)](https://daily.dev/posts/container-image-security-signing-and-scanning-with-tools-like-cosign-trivy--rtw86fjgm) · InfoSec Write-ups · 0 upvotes · 0 comments - [Your container images are unsigned. In the AI era, that’s a ticking time bomb.](https://daily.dev/posts/your-container-images-are-unsigned-in-the-ai-era-that-s-a-ticking-time-bomb--cp7rfv8zj) · The New Stack · 0 upvotes · 0 comments - [A Container Image Can Be Vulnerability-Free and Still Not Be Trustworthy](https://daily.dev/posts/a-container-image-can-be-vulnerability-free-and-still-not-be-trustworthy-bpyeo5rdu) · Cloud Native Now · 0 upvotes · 0 comments --- Tags: [#docker](https://daily.dev/tags/docker), [#containers](https://daily.dev/tags/containers) [View this post on daily.dev](https://daily.dev/posts/docker-content-trust-retirement-and-migration-guidance-1ldxep4fb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Docker Content Trust: Retirement and Migration Guidance","url":"https://daily.dev/posts/docker-content-trust-retirement-and-migration-guidance-1ldxep4fb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/docker-content-trust-retirement-and-migration-guidance-1ldxep4fb"},"datePublished":"2026-06-16T18:34:35.609Z","dateModified":"2026-09-13T18:35:54.426Z","description":"Docker Content Trust (DCT) and the Notary v1 service at notary.docker.io are being fully retired by December 8, 2026. Fewer than 0.05% of Docker Hub pulls use...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7be8a0db8ab91f7126d8d6f3da0e7f7f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7be8a0db8ab91f7126d8d6f3da0e7f7f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Docker","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Docker","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/8a1022bebfc04a7d824c309bd3686787","url":"https://daily.dev/sources/docker"},"commentCount":2,"discussionUrl":"https://daily.dev/posts/docker-content-trust-retirement-and-migration-guidance-1ldxep4fb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":56},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":2}],"keywords":"docker,containers","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Docker","item":"https://daily.dev/sources/docker"},{"@type":"ListItem","position":3,"name":"Docker Content Trust: Retirement and Migration Guidance"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/docker-content-trust-retirement-and-migration-guidance-1ldxep4fb","comment":[{"@type":"Comment","text":"I wasn’t even aware of that.","datePublished":"2026-06-18T13:40:35.559Z","url":"https://daily.dev/posts/1LDXeP4FB#c-SQyQ3R20Z","author":{"@type":"Person","name":"Deep Joshi","url":"https://daily.dev/deepjoshi_dev","image":"https://media.daily.dev/image/upload/s--TdY8j8Aa--/f_auto/v1776506972/avatars/avatar_aSUkzUQS97QJpQRxKMe49?_a=BAMAMiWQ0"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"Funny, just a week ago I did all this already. Good to know, it’s still best practice.","datePublished":"2026-06-18T01:03:01.038Z","url":"https://daily.dev/posts/1LDXeP4FB#c-a8l0mlrlE","author":{"@type":"Person","name":"Daniel","url":"https://daily.dev/akkitto","image":"https://media.daily.dev/image/upload/s--FtwJqX4c--/f_auto/v1754900041/avatars/avatar_29TCpY2hJR72V3BlxPXzX?_a=BAMClqZW0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/docker-content-trust-retirement-and-migration-guidance-1ldxep4fb#faq","mainEntity":[{"@type":"Question","name":"When is Docker Content Trust (DCT) being fully shut down?","acceptedAnswer":{"@type":"Answer","text":"Docker Content Trust and the Notary v1 service at notary.docker.io shut down completely on December 8, 2026. Before that, scheduled brownouts test the transition: 4-hour write brownouts on July 14 and 15, 2026, and 4-hour read brownouts on August 10 and 12, 2026, all starting at 8AM Pacific Time. Ordinary docker pull and push keep working throughout. Teams tracking Docker security deprecations like this follow migration timelines on daily.dev."}},{"@type":"Question","name":"How do I replace Docker Content Trust for verifying image publisher identity?","acceptedAnswer":{"@type":"Answer","text":"Use Sigstore/Cosign or Notation, the two actively maintained signing tools that replaced DCT. Cosign supports identity-based signing with short-lived certificates tied to an OIDC identity, while Notation uses a certificate-based PKI model; both store signatures as OCI artifacts alongside the image in any compliant registry, avoiding DCT's separate trust infrastructure. Developers choosing a container signing tool compare options like Cosign and Notation on daily.dev."}},{"@type":"Question","name":"What should I do if my DOCKER_CONTENT_TRUST environment variable is set to 1?","acceptedAnswer":{"@type":"Answer","text":"Unset it or explicitly set DOCKER_CONTENT_TRUST=0 to disable Docker Content Trust and keep image pulls working after the shutdown. Check shell profiles, CI/CD configuration, Compose files, and Kubernetes manifests for the variable, since disabling it removes tag-level verification but is the fastest way to unblock pulls before December 8, 2026. Engineers untangling deprecated env vars during Docker upgrades track fixes like this on daily.dev."}}]} ```