Azure Container Registry: Docker Content Trust retirement

Docker Content Trust is completely removed from Azure Container Registry on 31 Mar 2028. Data stored in the registry for signing and verifying signatures with Docker Content Trust is permanently deleted on the same date. Since September 30, 2025, customers have not been able to enable Docker Content Trust on Azure Container Registry. Registries that currently use Docker Content Trust to sign images or verify signatures are affected.

1. Move from Docker Content Trust to the Notary Project ecosystem, including its open-source tool Notation.
2. For signing, use Azure Key Vault with self-signed certificates or CA-issued certificates.
3. To sign in pipelines, see Sign in ADO pipelines and Sign in GitHub workflows.
4. For verification, see Verify in ADO pipelines, Verify in GitHub workflows and Verify on AKS.