Time to Bail · Boarding pass
Act. You can stay.
Notary.docker.io shuts down December 8, 2026. Turn off DCT, or sign with Cosign or Notation first.[1]
Act means: change a setting or plan before the date. You can stay.
Docker Content Trust and notary.docker.io shut down December 8, 2026
Docker ends Docker Content Trust (DCT) on December 8, 2026. Its Notary v1 server at notary.docker.io shuts down that day. This only matters if you set DOCKER_CONTENT_TRUST=1 or use docker trust commands. Normal docker pull and push keep working.
One email with the first steps. Nothing else.
Or add the date to your calendar: Apple or Outlook (.ics) · Google Calendar
Tick steps as you go. Your progress stays in this browser.
Look for DOCKER_CONTENT_TRUST and docker trust in CI files, shell profiles, Compose files and Kubernetes files.
Unset DOCKER_CONTENT_TRUST or set it to 0.
Use the image digest instead of only a tag in Dockerfiles, so you always get the same image.
If you need signatures, use Cosign or Notation. Check them with Kyverno or Ratify.
One email with the first steps. Nothing else.
Or add the date to your calendar: Apple or Outlook (.ics) · Google Calendar
| Full shutdown | December 8, 2026[2] |
|---|---|
| Who is affected | You set DOCKER_CONTENT_TRUST=1, use docker trust sign, inspect or revoke, or check DCT signatures in deploy policies[2] |
| Not affected | Normal docker pull and docker push, if you never turned DCT on[2] |
| Brownouts (already done) | July 14 and July 15, 2026 for writes; August 10 and August 12, 2026 for reads[2] |
| Docker Hub pulls that use DCT | Fewer than 0.05%[2] |
| Fastest fix | unset DOCKER_CONTENT_TRUST, or set DOCKER_CONTENT_TRUST=0[2] |
| Signing tools Docker points to | Sigstore/Cosign and Notation[2] |
| If you sign images on Docker Hub | Docker cannot make new signatures for you; sign with Cosign or Notation[2] |
| First announced | July 2025[2] |
| Guide posted | June 16, 2026[2] |
| Setups with DCT turned on | Lose the Notary v1 service on December 8, 2026[2] |
Check it yourself. Every fact above links here.
Time to bail on Docker Content Trust signing and checks? Act. You can stay. Notary.docker.io shuts down December 8, 2026. Turn off DCT, or sign with Cosign or Notation first.
On our scale this is Act: change a setting or plan before the date. You can stay.
Docker ends Docker Content Trust (DCT) on December 8, 2026. Its Notary v1 server at notary.docker.io shuts down that day. This only matters if you set DOCKER_CONTENT_TRUST=1 or use docker trust commands. Normal docker pull and push keep working.
Here are the facts we checked:
You can stay on Docker. You have to change a setting or plan before the date.
Leaving is a choice here, not a must.
Docker is the main source for this page. Docker has not said more than what is listed here. If a fact is not on this page, we do not know it yet.
Setups with DCT turned on: Lose the Notary v1 service on December 8, 2026.
The date to remember is December 8, 2026. Make the change before then.
A few tips:
If the change affects your members or team, send one short email. Say what changes for them and when. Put the most important line first.
If there is a date, send a short reminder a few days before it. Keep a copy of the list you sent it to.
Listed for convenience. Not ranked. Not paid. These names come up in threads and reviews; that does not show where people moved.
Before you pay, check the price page of each tool yourself. Prices change, and we only list what our sources say.
No questions collected yet.
Thanks.
Run SaaS spend at work? Get these changes before the invoice
Arrivals · for builders
People on Docker Content Trust signing and checks can stay if they make the change. Some would rather leave. Get the playbook for this change, and list your product here.
Listing is free. An editor checks it. Not ranked. Not paid.
One email when we publish a checked change in the category you pick. No account needed.
One email on Mondays: the gates in the next 14 days, with the first step for each.