nprasad2077/docker-docs
1
0 Fork 0
mirror of https://github.com/docker/docs.git synced 2026-11-04 10:01:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

dhi: add eu data residency (#26186)

Browse Source 
## Description

Document EU data residency for Docker Hardened Images. Docker can
provision a DHI subscription in the EU region. When it does, Docker
stores the organization's mirrored and customized images in the EU.


| Page | What changed |
| --- | --- |
|
[`eu-region.md`](https://deploy-preview-26186--docsdocker.netlify.app/dhi/explore/eu-region/)
| New page. How the region is set and checked, what Docker stores in the
EU, and the limitations: no file content in customizations, no VEX for
customized images, and Docker Scout isn't turned on automatically |
|
[`customize.md`](https://deploy-preview-26186--docsdocker.netlify.app/dhi/how-to/customize/)
| Notes that file content and the `paths` field aren't supported in the
EU region. Renames the **Scripts** section to **Files** to match the UI,
and adds the **Symlinks** section |
|
[`mirror.md`](https://deploy-preview-26186--docsdocker.netlify.app/dhi/how-to/mirror/)
| Adds a section about mirrors in the EU region, including that mirrors
created before the move stay in their original region |
|
[`platform.md`](https://deploy-preview-26186--docsdocker.netlify.app/dhi/release-notes/platform/)
| Q4 2026 release note for EU data residency |
|
[`_index.md`](https://deploy-preview-26186--docsdocker.netlify.app/dhi/explore/)
| Adds a grid card for the new page |
|
[`dhi.md`](https://deploy-preview-26186--docsdocker.netlify.app/subscription/plans/dhi/)
| Tip in the Usage section that points to EU data residency |

## Related issues or tickets

RG-4464, DSB-69, DSB-174

## Reviews

- [ ] Technical review
- [ ] Editorial review
- [ ] Product review

---------

Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
This commit is contained in:
Craig Osterhout authored and GitHub committed 2026-10-12 10:05:59 -07:00
1 parent 3f5e702096
commit 547efd2d03
8 files changed
+180 -37
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

content/manuals/dhi/explore/_index.md
+4
View File
@@ -33,6 +33,10 @@ params:
description: Understand Docker's role and your responsibilities when using Docker Hardened Images as part of your secure software supply chain.
icon: user-group
link: /dhi/explore/responsibility/
- title: EU data residency
description: Learn how Docker stores your mirrored and customized images in the EU when your subscription is in the EU region.
icon: globe-alt
link: /dhi/explore/eu-region/
- title: Security concepts
description: Learn the core concepts behind Docker Hardened Images — signed attestations, immutable digests, SLSA, VEX, and more.
icon: clipboard-document-check
content/manuals/dhi/explore/eu-region.md
+80
View File
@@ -0,0 +1,80 @@
---
title: EU data residency for Docker Hardened Images
linkTitle: EU data residency
description: Learn how Docker stores your mirrored and customized Docker Hardened Images in the EU when your DHI subscription is in the EU region, and what works differently in that region.
keywords: docker hardened images, dhi, eu region, data residency, europe, mirror, customization
weight: 48
---
{{< summary-bar feature_name="Docker Hardened Images EU data residency" >}}
Docker can provision your organization's Docker Hardened Images (DHI)
subscription in the EU region. When your subscription is in the EU region,
Docker stores your mirrored and customized images in the EU.
## How your region is set
Docker sets the region on your DHI subscription. Docker doesn't detect your
region automatically. To have your subscription provisioned in the EU region,
or to change its region, contact your Docker account representative or <a
href="https://www.docker.com/pricing/contact-sales/"
id="dkr_docs_cs_dhi_eu_region" class="link" rel="noopener">Docker
sales</a>.
If you plan to use the EU region, request it before you start mirroring.
Mirrors that you create before your subscription moves to the EU region stay
in their original region.
## Check your region
1. Sign in to [Docker Hub](https://hub.docker.com).
1. Select **My Hub**.
1. In the namespace drop-down, select your organization.
1. Select **Hardened Images** > **Manage**.
When your subscription is in the EU region, the subscription label shows
**Your subscription (Region EU)**. When it shows only **Your subscription**,
your subscription is in the default US region.
## What Docker stores in the EU
When your subscription is in the EU region, Docker stores the following in the
EU:
- The repositories that Docker creates when you [mirror a DHI
repository](../how-to/mirror.md) to your organization on Docker Hub, and
their attestations
- Your [customized images](../how-to/customize.md) and their attestations
OCI artifacts that you use in customizations are stored in the region of the
repository that you push them to. To keep them in the EU, push them to
repositories in the EU region.
Your region doesn't apply to repositories that you [mirror to a third-party
registry](../how-to/mirror.md#mirror-a-dhi-repository-to-a-third-party-registry).
Where that content is stored depends on the registry you use.
## Attestations in the EU region
Docker stores attestations with the images in your Docker Hub repository. For
mirrored repositories, Docker copies only the attestations created when the
image is built. Attestations that Docker Scout generates, such as VEX
statements and vulnerability reports, aren't available in the EU region. To
see which attestations are available, see [Image
attestations](./security-concepts/attestations.md#image-attestations).
## Limitations in the EU region
Mirroring and customization in the EU region work the same as in other regions,
with the following differences:
- You can't [add files](../how-to/customize.md#inject-files-into-the-image)
that you write directly in a customization, such as configuration files or
setup scripts. This doesn't affect files that come from OCI artifacts. You can
still add packages, OCI artifacts, and symlinks.
- Docker doesn't provide VEX statements or vulnerability reports for your
mirrored repositories or customized images.
- Docker doesn't turn on Docker Scout image analysis for your mirrored
repositories or customized images in the EU region. If you turn on Docker
Scout image analysis for a repository in the EU region, the data that Docker
Scout processes is stored in the US.
content/manuals/dhi/explore/security-concepts/attestations.md
+40 -30
View File
@@ -73,24 +73,29 @@ $ docker scout attest list dhi.io/<image>:<tag>
For more details, see [Verify image attestations](../../how-to/verify.md#verify-image-attestations).
| Attestation type | Description |
|----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| CycloneDX SBOM | A software bill of materials in [CycloneDX](https://cyclonedx.org/) format, listing components, libraries, and versions. |
| STIG scan | Results of a STIG scan, with output in HTML and XCCDF formats. |
| CVEs (In-Toto format) | A list of known vulnerabilities (CVEs) affecting the image's components, based on package and distribution scanning. |
| VEX | A [Vulnerability Exploitability eXchange (VEX)](https://openvex.dev/) document that identifies vulnerabilities that do not apply to the image and explains why (e.g., not reachable or not present). |
| Scout provenance | Provenance metadata generated by Docker Scout, including the source Git commit, build parameters, and environment details. |
| Scout SBOM | An SBOM generated and signed by Docker Scout, including additional Docker-specific metadata. |
| Secrets scan | Results of a scan for accidentally included secrets, such as credentials, tokens, or private keys. |
| Tests | A record of automated tests run against the image, such as functional checks or validation scripts. |
| Virus scan | Results of antivirus scans performed on the image layers. For details, see [Malware scanning](../malware-scanning.md). |
| CVEs (Scout format) | A vulnerability report generated by Docker Scout, listing known CVEs and severity data. |
| SLSA provenance | A standard [SLSA](https://slsa.dev/) provenance statement describing how the image was built, including build tool, parameters, and source. |
| SLSA verification summary | A summary attestation indicating the image's compliance with SLSA requirements. |
| SPDX SBOM | An SBOM in [SPDX](https://spdx.dev/) format, widely adopted in open-source ecosystems. |
| FIPS compliance | An attestation that verifies the image uses FIPS 140-validated cryptographic modules. |
| DHI Changelog | A record of changes made to the image across versions. |
| DHI Image Sources | Links to a corresponding source image containing all materials used to build the image, including package source code, Git repositories, and local files, ensuring compliance with open source license requirements. |
The **Available in the EU region** column applies only if your organization's
DHI subscription is in the EU region. It shows which attestations are available
for your mirrored repositories in that region. For details, see [EU data
residency](../eu-region.md#attestations-in-the-eu-region).
| Attestation type | Description | Available in the EU region |
|----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------|
| CycloneDX SBOM | A software bill of materials in [CycloneDX](https://cyclonedx.org/) format, listing components, libraries, and versions. | No |
| STIG scan | Results of a STIG scan, with output in HTML and XCCDF formats. | Yes |
| CVEs (In-Toto format) | A list of known vulnerabilities (CVEs) affecting the image's components, based on package and distribution scanning. | No |
| VEX | A [Vulnerability Exploitability eXchange (VEX)](https://openvex.dev/) document that identifies vulnerabilities that do not apply to the image and explains why (e.g., not reachable or not present). | No |
| Scout provenance | Provenance metadata generated by Docker Scout, including the source Git commit, build parameters, and environment details. | No |
| Scout SBOM | An SBOM generated and signed by Docker Scout, including additional Docker-specific metadata. | No |
| Secrets scan | Results of a scan for accidentally included secrets, such as credentials, tokens, or private keys. | Yes |
| Tests | A record of automated tests run against the image, such as functional checks or validation scripts. | Yes |
| Virus scan | Results of antivirus scans performed on the image layers. For details, see [Malware scanning](../malware-scanning.md). | Yes |
| CVEs (Scout format) | A vulnerability report generated by Docker Scout, listing known CVEs and severity data. | No |
| SLSA provenance | A standard [SLSA](https://slsa.dev/) provenance statement describing how the image was built, including build tool, parameters, and source. | Yes |
| SLSA verification summary | A summary attestation indicating the image's compliance with SLSA requirements. | Yes |
| SPDX SBOM | An SBOM in [SPDX](https://spdx.dev/) format, widely adopted in open-source ecosystems. | Yes |
| FIPS compliance | An attestation that verifies the image uses FIPS 140-validated cryptographic modules. | Yes |
| DHI Changelog | A record of changes made to the image across versions. | Yes |
| DHI Image Sources | Links to a corresponding source image containing all materials used to build the image, including package source code, Git repositories, and local files, ensuring compliance with open source license requirements. | Yes |
## Package attestations
@@ -123,18 +128,23 @@ $ docker scout attest list dhi.io/<chart>:<version>
For more details, see [Verify Helm chart attestations](../../how-to/verify.md#verify-helm-chart-attestations-with-docker-scout).
| Attestation type | Description |
|----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| CycloneDX SBOM | A software bill of materials in [CycloneDX](https://cyclonedx.org/) format, listing the chart itself and all container images and tools referenced by the chart. |
| CVEs (In-Toto format) | A list of known vulnerabilities (CVEs) affecting the container images and components referenced by the chart. |
| Scout provenance | Provenance metadata generated by Docker Scout, including the chart source repository, build images used, and build parameters. |
| Scout SBOM | An SBOM generated and signed by Docker Scout, including the chart and container images it references, with additional Docker-specific metadata. |
| Secrets scan | Results of a scan for accidentally included secrets, such as credentials, tokens, or private keys, in the chart package. |
| Tests | A record of automated tests run against the chart to validate functionality and compatibility with referenced images. |
| Virus scan | Results of antivirus scans performed on the chart package. For details, see [Malware scanning](../malware-scanning.md). |
| CVEs (Scout format) | A vulnerability report generated by Docker Scout, listing known CVEs and severity data for the chart's referenced images. |
| SLSA provenance | A standard [SLSA](https://slsa.dev/) provenance statement describing how the chart was built, including build tool, source repository, referenced images, and build materials. |
| SPDX SBOM | An SBOM in [SPDX](https://spdx.dev/) format, listing the chart and all container images and tools it references. |
The **Available in the EU region** column applies only if your organization's
DHI subscription is in the EU region. It shows which attestations are available
for your mirrored Helm charts in that region. For details, see [EU data
residency](../eu-region.md#attestations-in-the-eu-region).
| Attestation type | Description | Available in the EU region |
|----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------|
| CycloneDX SBOM | A software bill of materials in [CycloneDX](https://cyclonedx.org/) format, listing the chart itself and all container images and tools referenced by the chart. | No |
| CVEs (In-Toto format) | A list of known vulnerabilities (CVEs) affecting the container images and components referenced by the chart. | No |
| Scout provenance | Provenance metadata generated by Docker Scout, including the chart source repository, build images used, and build parameters. | No |
| Scout SBOM | An SBOM generated and signed by Docker Scout, including the chart and container images it references, with additional Docker-specific metadata. | No |
| Secrets scan | Results of a scan for accidentally included secrets, such as credentials, tokens, or private keys, in the chart package. | Yes |
| Tests | A record of automated tests run against the chart to validate functionality and compatibility with referenced images. | Yes |
| Virus scan | Results of antivirus scans performed on the chart package. For details, see [Malware scanning](../malware-scanning.md). | Yes |
| CVEs (Scout format) | A vulnerability report generated by Docker Scout, listing known CVEs and severity data for the chart's referenced images. | No |
| SLSA provenance | A standard [SLSA](https://slsa.dev/) provenance statement describing how the chart was built, including build tool, source repository, referenced images, and build materials. | Yes |
| SPDX SBOM | An SBOM in [SPDX](https://spdx.dev/) format, listing the chart and all container images and tools it references. | Yes |
## View and verify attestations
content/manuals/dhi/how-to/customize.md
+32 -7
View File
@@ -104,18 +104,36 @@ You can create customizations using either the DHI CLI or the Docker Hub web int
For more details, see [OCI artifacts](#oci-artifacts).
1. In the **Scripts** section, you can add, edit, or remove scripts.
1. In the **Files** section, you can add, edit, or remove files.
Scripts let you add files to the container image that you can access at runtime. They are not executed during
the build process. This is useful for services that require pre-start initialization, such as setup scripts or
Files let you add static content to the container image that you can
access at runtime, such as configuration files or setup scripts. Files
are not executed during the build process. This is useful for services
that require initialization before they start, such as setup scripts or
file writes to directories like `/var/lock` or `/out`.
You must specify the following:
- The path where the script will be placed
- The script content
- The UID and GID ownership of the script
- The octal file permissions of the script
- The path where the file will be placed
- The file content
- The UID and GID ownership of the file
- The octal file permissions of the file
> [!NOTE]
>
> If your organization's DHI subscription is in the EU region, the
> **Add** option in the **Files** section is greyed out. File content
> isn't supported in the EU region. For details, see [EU data
> residency](../explore/eu-region.md).
1. In the **Symlinks** section, you can add, edit, or remove symbolic links.
You must specify the following:
- The path where the symlink will be placed
- The source path that the symlink points to
Optionally, you can specify the UID and GID ownership of the symlink.
1. Select **Next: Configure** to configure the following image settings:
@@ -380,6 +398,13 @@ paths:
| `uid` | User ID of the file owner. |
| `gid` | Group ID of the file owner. |
> [!NOTE]
>
> If your organization's DHI subscription is in the EU region, you can't add
> files with `contents` in the `paths` field. File content isn't supported in
> the EU region. For details, see [EU data
> residency](../explore/eu-region.md).
#### Configure user accounts
To add users or groups to the image, or to change which user the container
content/manuals/dhi/how-to/mirror.md
+8
View File
@@ -175,6 +175,14 @@ other Docker Hub repository, so you can manage access and permissions, configure
webhooks, and use other standard Hub features. See [Docker Hub
repositories](/manuals/docker-hub/repos/_index.md) for details.
### Mirrors in the EU region
If your organization's DHI subscription is in the EU region, Docker creates
your mirrored repositories on Docker Hub in the EU. Mirrors created before your
subscription moved to the EU region stay in their original region. For
details, including how to get a subscription in the EU region, see [EU data
residency](../explore/eu-region.md).
### Stop mirroring a repository
After you stop mirroring, the repository remains, but it no longer receives
content/manuals/dhi/release-notes/platform.md
+9
View File
@@ -11,6 +11,15 @@ This page contains information about the new features, improvements, and changes
in the Docker Hardened Images (DHI) platform. Release notes are aggregated by
quarter and include only notable product changes.
## Q4 2026
New features and enhancements released in the fourth quarter of 2026.
- EU data residency (early access): Docker can provision your DHI
subscription in the EU region. When your subscription is in the EU region,
Docker stores your mirrored and customized images in the EU. For more
information, see [EU data residency](../explore/eu-region.md).
## Q3 2026
New features and enhancements released in the third quarter of 2026.
content/manuals/subscription-billing/plans/dhi.md
+4
View File
@@ -33,6 +33,10 @@ DHI Enterprise extends DHI Select with unlimited customizations, optional full c
For details on setting up and managing repositories, see [Get started with DHI Select and Enterprise](/manuals/dhi/how-to/select-enterprise.md).
> [!TIP]
>
> EU data residency is in early access. Docker can provision your organization's DHI subscription in the EU region. To request it, contact your Docker account representative or <a href="https://www.docker.com/pricing/contact-sales/" id="dkr_docs_cs_plans_dhi_eu_region" class="link" rel="noopener">Docker sales</a>. For details, see [EU data residency for Docker Hardened Images](/manuals/dhi/explore/eu-region.md).
## Billing cycle
DHI Select is an annual plan billed per repository from the date your plan starts. Repositories added mid-cycle are prorated for the remainder of the billing period. You can add more repositories to your DHI Select plan by going to **Active plans** in the billing portal. For steps, see [Manage plans](/manuals/subscription-billing/manage/plans.md#upgrade-plans).
data/summary.yaml
+3
View File
@@ -177,6 +177,9 @@ Docker Hardened Images:
subscription: [Docker Hardened Images Select or Enterprise]
Docker Hardened Images Enterprise:
subscription: [Docker Hardened Images Enterprise]
Docker Hardened Images EU data residency:
availability: Early Access
subscription: [Docker Hardened Images Select or Enterprise]
Docker Init:
requires: Docker Desktop [4.27](/manuals/desktop/release-notes.md#4270) and later
Docker Model Runner: