How to use docker trust key load command to load a signing key

Introduction

In this lab, you will learn how to load a signing key into the Docker trust keystore using the docker trust key load command. You will begin by preparing a private key file for signing Docker images using openssl.

Following the key generation, you will load this private key into the Docker trust keystore, which is a secure location for cryptographic keys. Finally, you will explore how to load the private key with a specific name within the keystore.

Skills Graph

%%%%{init: {'theme':'neutral'}}%%%% flowchart RL docker(("Docker")) -.-> docker/ImageOperationsGroup(["Image Operations"]) docker(("Docker")) -.-> docker/VolumeOperationsGroup(["Volume Operations"]) docker/ImageOperationsGroup -.-> docker/tag("Tag an Image") docker/ImageOperationsGroup -.-> docker/images("List Images") docker/VolumeOperationsGroup -.-> docker/cp("Copy Data Between Host and Container") subgraph Lab Skills docker/tag -.-> lab-555253{{"How to use docker trust key load command to load a signing key"}} docker/images -.-> lab-555253{{"How to use docker trust key load command to load a signing key"}} docker/cp -.-> lab-555253{{"How to use docker trust key load command to load a signing key"}} end

Prepare a private key file for signing

In this step, you will learn how to prepare a private key file for signing Docker images. Docker Content Trust uses cryptographic keys to verify the integrity and authenticity of images. A private key is essential for signing images, while the corresponding public key is used by others to verify the signature.

First, navigate to the ~/project directory, which is your working directory for this lab.

cd ~/project

Now, generate a new RSA private key using the openssl command. This command will create a 4096-bit private key and save it to a file named my-signing-key.pem in your current directory.

openssl genrsa -out my-signing-key.pem 4096

You will see output indicating the key generation process. This command generates a private key in PEM format.

Next, let's verify that the file my-signing-key.pem has been created in your ~/project directory.

ls -l my-signing-key.pem

You should see the file listed with its permissions, owner, group, size, and modification time. This confirms that the private key file has been successfully generated.

Load the private key into the Docker trust keystore

In this step, you will load the private key you generated in the previous step into the Docker trust keystore. The Docker trust keystore is a secure location where Docker stores cryptographic keys used for signing and verifying images.

The Docker trust keystore is located in the ~/.docker/trust/private directory. You need to copy the private key file you created (my-signing-key.pem) into this directory.

First, ensure you are in the ~/project directory where you created the private key.

cd ~/project

Now, copy the my-signing-key.pem file to the Docker trust private key directory. You might need to create the directory if it doesn't exist.

mkdir -p ~/.docker/trust/private
cp my-signing-key.pem ~/.docker/trust/private/

The mkdir -p command creates the directory and any necessary parent directories if they don't already exist. The cp command copies the private key file.

After copying the file, you can verify that the private key is now in the Docker trust keystore by listing the contents of the ~/.docker/trust/private directory.

ls ~/.docker/trust/private/

You should see my-signing-key.pem listed in the output. This confirms that the private key has been successfully loaded into the Docker trust keystore.

Load the private key with a specific name

In this step, you will learn how to load a private key into the Docker trust keystore with a specific name. While you can simply copy the key file as you did in the previous step, using the docker trust key load command allows you to associate a specific name with the key within the Docker trust system. This can be helpful for managing multiple signing keys.

First, ensure you are in the ~/project directory where you created the private key file my-signing-key.pem.

cd ~/project

Now, use the docker trust key load command to load the private key. You will be prompted to enter a name for the key. Let's name this key my-signer.

docker trust key load my-signing-key.pem --name my-signer

When prompted, enter my-signer as the name for the key.

Loading key from 'my-signing-key.pem'...
Enter name for new key: my-signer

After entering the name, you will be prompted to enter a passphrase for the new key. For this lab, you can leave the passphrase empty by just pressing Enter. In a real-world scenario, it is highly recommended to use a strong passphrase to protect your private key.

Enter passphrase for new key:
Repeat passphrase for new key:

You should see output indicating that the key has been successfully loaded.

Successfully loaded private key from 'my-signing-key.pem' with ID '...'

To verify that the key has been loaded with the specified name, you can list the keys in your Docker trust keystore using the docker trust key list command.

docker trust key list

You should see an entry with the NAME my-signer and a corresponding KEY ID. This confirms that you have successfully loaded the private key with a specific name.

Summary

In this lab, you learned how to prepare a private key file for signing Docker images using openssl genrsa. You then practiced loading this generated private key into the Docker trust keystore by copying the key file to the ~/.docker/trust/private directory.