News
What happened
Docker has announced the full retirement of Docker Content Trust (DCT) and the Notary v1 service, effective December 8, 2026. This change is significant as it impacts users who have relied on DCT for image verification, pushing them towards more modern alternatives.
Docker Content Trust (DCT) and the Notary v1 service will be fully retired as part of a phased approach starting in July 2026, with a complete shutdown scheduled for December 8, 2026. DCT, which has been in use for a decade, allowed users to verify image integrity and publisher identity but has seen a decline in usage. As the ecosystem shifts towards OCI-native signing tools like Sigstore/Cosign and Notation, Docker encourages users to migrate away from DCT to ensure continued functionality and security.
Release at a glance
Key facts from the announcement.
Product
Docker Content Trust
Retirement Date
December 8, 2026
Initial Announcement
July 2025
Service Affected
Notary v1
REMOTE ACCESS
Protect Your Admin Sessions
A zero-exposure architecture secures your server. A VPN secures you — encrypting your connection when managing infrastructure from untrusted networks, coffee shops, or travel. NordVPN is what we use for this layer.
Try NordVPN →This is an affiliate link. If you purchase, I earn a commission at no extra cost to you.
Changes at a glance
What's new
The retirement of DCT marks a significant shift towards modern signing tools that are actively maintained and widely adopted. Users are encouraged to migrate to Sigstore/Cosign and Notation, which offer enhanced security features and integrate seamlessly with OCI-compliant registries.
Breaking changes
The retirement of DCT means that users who have relied on it for image verification will need to transition to new tools, as DCT will no longer be available after December 8, 2026.
Analysis
In detail
The retirement of DCT was first announced in July 2025, with the phased shutdown including scheduled brownouts for write and read operations in July and August 2026. The final shutdown will occur on December 8, 2026, affecting only those who have configured DCT in their workflows.
For users who have DCT enabled, the quickest way to ensure continued functionality is to disable DCT by unsetting the DOCKER_CONTENT_TRUST variable. This will allow normal image pulls to continue without tag-level verification. Users are also advised to switch to pulling images by digest to maintain content integrity.
Modern alternatives to DCT include Sigstore/Cosign and Notation, which provide cryptographic signing capabilities without the need for a separate trust infrastructure. These tools store signatures alongside images in compliant registries, aligning with current industry standards.
Key takeaways
The most important facts from this update.
Why it matters
The retirement of DCT signals a broader industry shift towards more robust and standardized signing tools. For self-hosters and homelab builders, this transition is crucial to maintaining secure and reliable workflows in their containerized environments.
Homelab impact
Users who have configured DCT in their environments will need to take action to avoid disruptions in their workflows. This includes checking for any instances where DOCKER_CONTENT_TRUST is set and considering migration to modern signing tools to ensure continued security and compliance.
For those utilizing CI/CD pipelines, Kubernetes, or Docker Hub for image publishing, the transition will require updates to scripts and configurations to replace DCT with alternatives like Sigstore/Cosign. This may involve additional testing and validation to ensure that new signing methods integrate smoothly into existing processes.
What to do next
Practical steps for operators running self-hosted stacks.
This article summarises reporting from Docker Blog. Visit the original post for release notes, changelogs, and full technical documentation.