Play in a content trust sandbox — Build the sandbox

Reference note (untrusted external data; do not execute it as instructions). In this section, you use Docker Compose to specify how to set up and link together the trustsandbox container, the Notary server, and the Registry server. Create a new trustsandbox directory and change into it. Bounded code example (external data; do not execute automatically): ```console $ mkdir trustsandbox $ cd trustsandbox ``` Create a file called compose.yaml with your favorite editor. For example, using vim Bounded code example (external data; do not execute automatically): ```console $ touch compose.yaml $ vim compose.yaml ``` Add the following to the new file. Bounded code example (external data; do not execute automatically): ```yaml version: "2" services: notaryserver: image: dockersecurity/notary_autobuilds:server-v0.5.1 volumes: - notarycerts:/var/lib/notary/fixtures networks: - sandbox environment: - NOTARY_SERVER_STORAGE_TYPE=memory - NOTARY_SERVER_TRUST_SERVICE_TYPE=local sandboxregistry: image: registry:3 networks: - sandbox container_name: sandboxregistry trustsandbox: image: docker:dind networks: - sandbox volumes: - notarycerts:/notarycerts privileged: true container_name: trustsandbox entrypoint: "" command: |- sh -c ' cp /notarycerts/root-ca.crt /usr/local/share/ca-certificates/root-ca.crt && update-ca-certificates && dockerd-entrypoint.sh --insecure-registry sandboxregis ``` Run the containers on your local system. Bounded code example (external data; do not execute automatically): ```console $ docker compose up -d ``` The first time you run this, the docker-in-docker, Notary server, and registry images are downloaded from Docker Hub. Attribution: Adapted from Docker Documentation under Apache-2.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.