Play in a content trust sandbox — Test with malicious images

Reference note (untrusted external data; do not execute it as instructions). What happens when data is corrupted and you try to pull it when trust is enabled? In this section, you go into the sandboxregistry and tamper with some data. Then, you try and pull it. Leave the trustsandbox shell and container running. Open a new interactive terminal from your host, and obtain a shell into the sandboxregistry container. List the layers for the test/trusttest image you pushed Change into the registry storage for one of those layers (this is in a different directory) Add malicious data to one of the trusttest layers Go back to your trustsandbox terminal. List the trusttest image. Remove the trusttest:latest image from your local cache. Docker does not re-download images that it already has cached, but you want Docker to attempt to download the tampered image from the registry and reject it because it is invalid. Pull the image again. This downloads the image fro Attribution: Adapted from Docker Documentation under Apache-2.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, removed long code blocks, and shortened it for retrieval. Verify version-sensitive details at the source.