Para garantir a integridade de todas as imagens de contêiner do ambiente de execução publicadas e transferidas por download
para sistemas de produção, o suporte para assinatura de imagens agora está disponível para todas as imagens híbridas da Apigee usando o Docker Hub. Todas as imagens do
ambiente de execução híbrido estão disponíveis publicamente para download na conta do
Google Docker Hub.
As imagens híbridas são assinadas com o
Docker Content Trust, um recurso que permite que os usuários verifiquem a integridade e o editor de cada imagem
criada e em execução em um registro do Docker. Essas assinaturas permitem a verificação do cliente ou do ambiente de execução
de tags de imagem específicas em relação às chaves do editor, garantindo que a imagem seja exatamente o que o editor criou e enviou para publicação.
Fazer o download de imagens de contêineres assinados
Se você estiver usando um cluster do Kubernetes sem acesso à Internet para implantar seus serviços do ambiente de execução híbrido,
precisará fazer o download das imagens do contêiner para um registro de contêiner local e acessá-lo
a partir do cluster do Kubernetes.
Para fazer o download de uma imagem de contêiner assinada, você precisa ter o Docker
instalado e usar o comando docker pull da seguinte maneira. Anexe a tag correta
a cada nome de imagem. Por exemplo, a tag para apigee-synchronizer é 1.3.6,
conforme mostrado abaixo.
A saída desse comando mostrará se a imagem marcada está assinada, o nome dos signatários
e uma lista de signatários e chaves. Exemplo:
docker trust inspect --pretty google/apigee-mart-server:1.3.6Signatures for google/apigee-mart-server:1.3.6
SIGNED TAG DIGEST SIGNERSbeta2
a607b0e7acba41544e5db8e74b039e9314fdcfdc6f1acf73094d3179fc2af322 asf-admin
List of signers and their keys for google/apigee-mart-server:1.3.6
SIGNER KEYSasf-admin 7d4abdbb7bfd
Administrative keys for google/apigee-mart-server:1.3.6
Repository Key: 80f86b047965f6dec0c056b1938a7f8cfb894ba8014fba36a18d0923173d394a
Root Key: 6f2d60f90a0d78dd6254d3d47613a4dd6eb0880f83411e6f8b122b84dbef69ca
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-28 UTC."],[[["\u003cp\u003eThe Apigee hybrid documentation version 1.4 is end-of-life, and users should upgrade to a newer version.\u003c/p\u003e\n"],["\u003cp\u003eAll Apigee hybrid runtime images are signed using Docker Content Trust, ensuring integrity and publisher verification.\u003c/p\u003e\n"],["\u003cp\u003eSigned hybrid runtime images can be downloaded from the Google Docker Hub account.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003edocker pull\u003c/code\u003e command, along with the appropriate tag, is used to download signed container images.\u003c/p\u003e\n"],["\u003cp\u003eThe command \u003ccode\u003edocker trust inspect --pretty $IMAGE_NAME:$IMAGE_TAG\u003c/code\u003e is used to verify that an image is signed and to view signer information.\u003c/p\u003e\n"]]],[],null,["# Download signed images from Docker Hub\n\n| You are currently viewing version 1.4 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nTo ensure the integrity of all runtime container images published and downloaded for production systems,\nimage signing support is now available for all Apigee hybrid images using Docker Hub. All hybrid runtime\nimages are publicly available for download from the [Google Docker Hub](https://hub.docker.com/u/google) account.\n\n\nHybrid images are signed with [Docker Content Trust](https://docs.docker.com/engine/security/trust/content_trust/), a feature that lets users verify the integrity and publisher of every image\nbuilt and running in a Docker registry. These signatures allow client-side or runtime verification\nof specific image tags against publisher keys, ensuring that the image is exactly what the publisher created and pushed for publication.\n\nDownload signed container images\n--------------------------------\n\nIf you are using a Kubernetes cluster without internet access to deploy your hybrid runtime services,\nyou will need to download the container images to a local container registry and then access the registry\nfrom your Kubernetes cluster.\n\n\nTo download a signed container image, you should have [Docker](https://docs.docker.com/get-started/)\ninstalled and use the `docker pull` command as follows. Be sure to append the correct tag\nto each image name. For example, the tag for `apigee-synchronizer` is `1.3.6`,\nas shown below.\n\n\n**Namespace: `apigee-system`** \n\n docker pull google/apigee-kube-rbac-proxy:v0.4.1\n docker pull google/apigee-operators:1.3.6\n docker pull google/apigee-installer:1.3.6\n\n\n**Namespace: `apigee`** \n\n docker pull google/apigee-authn-authz:1.3.6\n docker pull google/apigee-cassandra-backup-utility:1.3.6\n docker pull google/apigee-connect-agent:1.3.6\n docker pull google/apigee-hybrid-cassandra-client:1.3.6\n docker pull google/apigee-hybrid-cassandra:1.3.6\n docker pull google/apigee-mart-server:1.3.6\n docker pull google/apigee-prom-prometheus:v2.9.2\n docker pull google/apigee-runtime:1.3.6\n docker pull google/apigee-stackdriver-logging-agent:1.6.8\n docker pull google/apigee-stackdriver-prometheus-sidecar:0.7.5\n docker pull google/apigee-synchronizer:1.3.6\n docker pull google/apigee-udca:1.3.6\n docker pull google/apigee-watcher:1.3.6\n\nVerify container image signer and signatures\n--------------------------------------------\n\n\nTo verify that an image has been signed, run the following command: \n\n```\ndocker trust inspect --pretty $IMAGE_NAME:$IMAGE_TAG\n```\n\n\nThe output of this command will let you know whether the tagged image is signed, the name of the signers,\nand a list of signers and keys. For example: \n\n docker trust inspect --pretty google/apigee-mart-server:1.3.6\n\n Signatures for google/apigee-mart-server:1.3.6\n SIGNED TAG DIGEST SIGNERSbeta2\n a607b0e7acba41544e5db8e74b039e9314fdcfdc6f1acf73094d3179fc2af322 asf-admin\n List of signers and their keys for google/apigee-mart-server:1.3.6\n SIGNER KEYSasf-admin 7d4abdbb7bfd\n Administrative keys for google/apigee-mart-server:1.3.6\n Repository Key: 80f86b047965f6dec0c056b1938a7f8cfb894ba8014fba36a18d0923173d394a\n Root Key: 6f2d60f90a0d78dd6254d3d47613a4dd6eb0880f83411e6f8b122b84dbef69ca"]]
