AZ485241 - Retirement: Docker Content Trust on March 31, 2028 – Replaced by the Notary Project and Azure Key Vault

Azure Container Registry (ACR) implements Docker Content Trust (DCT), allowing image publishers to sign their images and image consumers to verify that the images they pull are signed. With advancements in technology, Docker Content Trust no longer meets the requirements of modern supply chain security for containers. As a result, Docker Content Trust will be deprecated and no longer available in ACR after March 31, 2028. If you currently use Docker Content Trust, you should transition to the Notary Project ecosystem, including their open-source supply chain tool, Notation.

How does this affect me?

• Starting September 30, 2025, customers will no longer be able to enable Docker Content Trust on Azure Container Registry.
• Data stored in Azure Container Registry for signing and verifying signatures with Docker Content Trust will be permanently deleted on March 31, 2028.
• Docker Content Trust function will be completely removed from Azure Container Registry on March 31, 2028.

Required Action

Start your transition to Notary Project today and enhance the security and trust of your container ecosystem. Use the following articles to get started.

Signing:

• Use AKV with self-signed certificates
• Use AKV with CA-issued certificates
• Sign in ADO pipelines
• Sign in GitHub workflows

• Verify in ADO pipelines
• Verify in GitHub workflows
• Verify on AKS