• Maintained by:
  Docker, Inc.

• Where to get help:
  the Docker Community Slack, Server Fault, Unix & Linux, or Stack Overflow

• server-0.7.0, server
• signer-0.7.0, signer

• Where to file issues:
  https://github.com/docker/notary-official-images/issues

• Supported architectures: (more info)
  amd64, arm32v6, arm64v8, i386, ppc64le, s390x

• Published image artifact details:
  repo-info repo's repos/notary/ directory (history)
  (image metadata, transfer size, etc)

• Image updates:
  official-images repo's library/notary label
  official-images repo's library/notary file (history)

• Source of this description:
  docs repo's notary/ directory (history)

The Notary respository contains two distinct applications, Notary Server, and Notary Signer. The images for these applications are tagged "server-*" and "signer-*" respectively. While the server can be configured to run entirely in memory, this configuration is not be appropriate for a production deployment so you should expect to run both a server and and signer.

Ensure that the images you are running have similar version tags. That is, if you are running the server-0.2.0 tag, you should also be running the similar signer-0.2.0 tag. Running different versions of the server and signer will never be a supported configuration.

The Notary server manages JSON formatted TUF (The Update Framework) metadata for Notary clients and the docker command line tool's Docker Content Trust features. It requires a companion Notary signer instance and a MySQL (or MariaDB) database.

The following sample configuration is included in the image:

{
    "server": {
        "http_addr": ":4443",
        "tls_key_file": "/certs/notary-server.key",
        "tls_cert_file": "/certs/notary-server.crt"
    },
    "trust_service": {
      "type": "remote",
      "hostname": "notarysigner",
      "port": "7899",
      "tls_ca_file": "/certs/root-ca.crt",
      "key_algorithm": "ecdsa",
      "tls_client_cert": "/certs/notary-server.crt",
      "tls_client_key": "/certs/notary-server.key"
    },
    "logging": {
        "level": "info"
    },
    "storage": {
        "backend": "mysql",
        "db_url": "server@tcp(mysql:3306)/notaryserver?parseTime=True"
    }
}

The components you must provide are the certificates and keys, and the links for the notarysigner and mysql hostnames. The root-ca.crt file enables the Notary server to identify valid signers, which it communicates with over mutual TLS using a GRPC interface. The notary-server.crt andnotary-server.key are used to identify this service to both external clients, and signer instances. All the certificate and key files must be readable by the notary user which is created inside the container and owns the notary-server process.

If you require a different configuration, you should wrap this image with your own Dockerfile.

For more details on how to configure your Notary server, please read the docs.

The Notary signer is a support service for the Notary server. It manages private keys and performs all signing operations. It requires a MySQL (or MariaDB) database.

The following sample configuration is included in the image:

{
    "server": {
        "http_addr": ":4444",
        "grpc_addr": ":7899",
        "tls_cert_file": "/certs/notary-signer.crt",
        "tls_key_file": "/certs/notary-signer.key",
        "client_ca_file": "/certs/notary-server.crt"
    },
    "logging": {
        "level": "info"
    },
    "storage": {
        "backend": "mysql",
        "db_url": "signer@tcp(mysql:3306)/notarysigner?parseTime=True"
    }
}

The components you must provide are the certificates and keys, and the link for the mysql hostname. The notary-server.crt file enables the Notary signer to identify valid servers, which it communicates with over mutual TLS using a GRPC interface. The notary-server.crt andnotary-server.key are used to identify this service to both external clients, and signer instances. All the certificate and key files must be readable by the notary user which is created inside the container and owns the notary-signer process.

If you require a different configuration, you should wrap this image with your own Dockerfile.

For more details on how to configure your Notary signer, please read the docs.

Notary server and signer both use the migrate tool to manage database updates. The migration files can be found here and are an ordered list of plain SQL files. The migrate tool manages schema versions to ensure that migrations start and end at the correct point.

We strongly recommend you create separate databases and users with restricted permissions such that the server cannot access the signer's database and vice versa.

View license information for the software contained in this image.

As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained).

Some additional license information which was able to be auto-detected might be found in the repo-info repository's notary/ directory.

As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.