Configuring Notary

Depending on the environment and purpose of running Notary services, there are two options: using docker-compose when running locally or running each service separately, usually through an orchestration layer (Kubernetes, Rancher, Swarm and so on). Configuring the latter is outside the scope of this document, while the former should only be used for demonstration purposes.

The following examples assume you will run Notary on your internal infrastructure and store Docker images on Amazon ECR.

Using docker-compose

The following examples assume that postgres was the choice of your backend.

Start by cloning the official repository:

❯ git clone
❯ git checkout v0.5.0

You can define the configuration via environment variables on the docker-compose.postgres.yml file that will override config settings. Alternatively you can also edit fixtures/server-config.postgres.json and fixtures/signer-config.postgres.json. If you choose to go with the default, no change is required.

Note that if you choose to use fixtures/ for local testing with Docker for using Docker-in-Docker for simulating multiple clients, make sure to add IP: to the subjectAltName or notaryserver to /etc/hosts, otherwise any Docker operation will result in a invalid certificate error.

If you have bootstrapped Notary before, you may need to delete its volume to get the new certificates reloaded (docker volume rm notary_notary_data). Beware that this will destroy all previously stored testing data.

docker-compose -f docker-compose.postgresql.yml up

If you chose not to sign the certificates using a previously-trusted internal CA, you will need to manually trust the fixtures/root-ca.crt, otherwise Docker will throw out this error when interacting with Notary:

ERRO[0000] could not reach Get x509: certificate signed by unknown authority

Trust the self-signed Notary's Intermediate CA:

❯ mkdir -p ~/.docker/tls/
❯ cp fixtures/intermediate-ca ~/.docker/tls/

From now on, Docker can be instructed to always use the private Notary server:


A completely separate environment can be created by using Docker-in-Docker, where delegations can be explored:

❯ docker run -d --privileged -e DOCKER_CONTENT_TRUST=1 -e DOCKER_CONTENT_TRUST_SERVER=https://notaryserver:4443 docker:dind

Then enter the container:

❯ docker exec -it 905c2a005f34745175299da9652a991860f965bbd1e24642e20c6abb9de03174 sh

/ # echo " notaryserver" >> /etc/hosts
/ # wget -O /usr/local/bin/notary && chmod a+x /usr/local/bin/notary

Make sure to add the Notary server certificate to /root/.docker/tls/notaryserver:4443/notaryserver.crt.

If using Amazon ECR for a private registry and credentials are needed, echo them to a local file and pipe it to shell:

❯ cat aws.login | sh

results matching ""

    No results matching ""