Docker-py: Trusted pulls from notary server are not supported

[mbolivar]

This is related to https://github.com/docker/compose/issues/4787.

There doesn't seem to be any way within the Python API to get the equivalent of what the Go CLI supports via the DOCKER_CONTENT_TRUST and DOCKER_CONTENT_TRUST_SERVER environment variables as described here:

https://docs.docker.com/engine/security/trust/trust_sandbox/

Since docker-compose is based on docker-py, that would seem it can't do trusted pulls. Is that right? If so, that's a fairly serious limitation.

Is there any plan or timeline to add support for notary servers? There is a Python library which implements tuf support (https://github.com/theupdateframework/tuf), so adding support for a notary server to docker-py would seem to be a matter of integrating it the same way the Go bindings are used in docker/cli.

[theo-walton]

yeah went from using subprocess to docker sdk and now back to subprocess because I need this feature...

[TOoSmOotH]

Any idea if this is going to be looked at? With the security breach with dockerhub this feature is more important than ever.

[bznein]

Any update on this?
DOCKER_CONTENT_TRUST is an important feature that forces all of us to use subprocess instead of docker-py.