starred/vaultwarden

Fork 0

mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-04-25 17:25:57 +03:00

[GH-ISSUE #1651] [Security] Is it time to sign the Docker images ?? #1025

New issue

Closed

opened 2026-03-03 02:05:37 +03:00 by kerem · 6 comments

kerem commented

2026-03-03 02:05:37 +03:00

Owner

Originally created by @williamdes on GitHub (Apr 30, 2021).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/1651

Subject of the issue

Docker images when signed are more "secure" in the case of a security event because a non signed image could not be pulled if the previous one was signed.

Deployment environment

Docker

Steps to reproduce

docker pull vaultwarden/server:latest --disable-content-trust=false

Error: remote trust data does not exist for docker.io/vaultwarden/server: notary.docker.io does not have trust data for docker.io/vaultwarden/server

Expected behaviour

Have a signed image I can trust

Actual behaviour

No signed image

Troubleshooting data

All needed information can be found in official docs and in the GitHub action: https://github.com/sudo-bot/action-docker-sign

All the needed commands can be copied from https://github.com/sudo-bot/action-docker-sign/blob/main/action.yml

Is it easy to implement: Yes

Do you have to backup in a very safe place the repository and root keys, YES !!

Knowing nothing about DCT I implemented a GitHub action in a bunch of hours, I can provide help for the setup if needed

Originally created by @williamdes on GitHub (Apr 30, 2021). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/1651 ### Subject of the issue Docker images when [signed](https://docs.docker.com/engine/security/trust/) are more "secure" in the case of a security event because a non signed image could not be pulled if the previous one was signed. ### Deployment environment Docker ### Steps to reproduce ``` docker pull vaultwarden/server:latest --disable-content-trust=false ``` ``` Error: remote trust data does not exist for docker.io/vaultwarden/server: notary.docker.io does not have trust data for docker.io/vaultwarden/server ``` ### Expected behaviour Have a signed image I can trust ### Actual behaviour No signed image ### Troubleshooting data All needed information can be found in official docs and in the GitHub action: https://github.com/sudo-bot/action-docker-sign All the needed commands can be copied from https://github.com/sudo-bot/action-docker-sign/blob/main/action.yml Is it easy to implement: Yes Do you have to backup in a very safe place the repository and root keys, YES !! Knowing nothing about DCT I implemented a GitHub action in a bunch of hours, I can provide help for the setup if needed

kerem closed this issue

2026-03-03 02:05:37 +03:00

kerem commented

2026-03-03 02:05:38 +03:00

Author

Owner

@williamdes commented on GitHub (Apr 30, 2021):

You can find examples on https://github.com/sudo-bot/action-docker-sign#inspect-trust

@williamdes commented on GitHub (Apr 30, 2021): You can find examples on https://github.com/sudo-bot/action-docker-sign#inspect-trust

kerem commented

2026-03-03 02:05:38 +03:00

Author

Owner

@dani-garcia commented on GitHub (Apr 30, 2021):

As our images are getting built automatically by Docker Hub's infrastructure, enabling this would imply giving them the private signing key directly, so would this add any extra security in that case?

@dani-garcia commented on GitHub (Apr 30, 2021): As our images are getting built automatically by Docker Hub's infrastructure, enabling this would imply giving them the private signing key directly, so would this add any extra security in that case?

kerem commented

2026-03-03 02:05:38 +03:00

Author

Owner

@williamdes commented on GitHub (Apr 30, 2021):

As our images are getting built automatically by Docker Hub's infrastructure, enabling this would imply giving them the private signing key directly, so would this add any extra security in that case?

Well, the auto-builds are not possible anymore with that option. The repository would need to build the images :/

@williamdes commented on GitHub (Apr 30, 2021): > As our images are getting built automatically by Docker Hub's infrastructure, enabling this would imply giving them the private signing key directly, so would this add any extra security in that case? Well, the auto-builds are not possible anymore with that option. The repository would need to build the images :/

kerem commented

2026-03-03 02:05:38 +03:00

Author

Owner

@williamdes commented on GitHub (Apr 30, 2021):

Switching to Images build with GitHub actions using a named env with run approvers seems to be the solution to make the secrets protected :)

@williamdes commented on GitHub (Apr 30, 2021): Switching to Images build with GitHub actions using a named env with run approvers seems to be the solution to make the secrets protected :)

kerem commented

2026-03-03 02:05:38 +03:00

Author

Owner

@williamdes commented on GitHub (May 8, 2021):

Do you think this could get implemented ?
I did add all the needed instructions for multi arch images on my repository

@williamdes commented on GitHub (May 8, 2021): Do you think this could get implemented ? I did add all the needed instructions for multi arch images on my repository

kerem commented

2026-03-03 02:05:38 +03:00

Author

Owner

@BlackDex commented on GitHub (Jun 21, 2021):

I'm going to move this to the discussions under Ideas, also to keep the issues for actual issues to the software.

@BlackDex commented on GitHub (Jun 21, 2021): I'm going to move this to the discussions under `Ideas`, also to keep the issues for actual issues to the software.