diff --git a/content/manuals/dhi/explore/_index.md b/content/manuals/dhi/explore/_index.md index 8336abaa81..c217ea77ae 100644 --- a/content/manuals/dhi/explore/_index.md +++ b/content/manuals/dhi/explore/_index.md @@ -33,6 +33,10 @@ params: description: Understand Docker's role and your responsibilities when using Docker Hardened Images as part of your secure software supply chain. icon: user-group link: /dhi/explore/responsibility/ + - title: EU data residency + description: Learn how Docker stores your mirrored and customized images in the EU when your subscription is in the EU region. + icon: globe-alt + link: /dhi/explore/eu-region/ - title: Security concepts description: Learn the core concepts behind Docker Hardened Images — signed attestations, immutable digests, SLSA, VEX, and more. icon: clipboard-document-check diff --git a/content/manuals/dhi/explore/eu-region.md b/content/manuals/dhi/explore/eu-region.md new file mode 100644 index 0000000000..bf6834b841 --- /dev/null +++ b/content/manuals/dhi/explore/eu-region.md @@ -0,0 +1,80 @@ +--- +title: EU data residency for Docker Hardened Images +linkTitle: EU data residency +description: Learn how Docker stores your mirrored and customized Docker Hardened Images in the EU when your DHI subscription is in the EU region, and what works differently in that region. +keywords: docker hardened images, dhi, eu region, data residency, europe, mirror, customization +weight: 48 +--- + +{{< summary-bar feature_name="Docker Hardened Images EU data residency" >}} + +Docker can provision your organization's Docker Hardened Images (DHI) +subscription in the EU region. When your subscription is in the EU region, +Docker stores your mirrored and customized images in the EU. + +## How your region is set + +Docker sets the region on your DHI subscription. Docker doesn't detect your +region automatically. To have your subscription provisioned in the EU region, +or to change its region, contact your Docker account representative or Docker +sales. + +If you plan to use the EU region, request it before you start mirroring. +Mirrors that you create before your subscription moves to the EU region stay +in their original region. + +## Check your region + +1. Sign in to [Docker Hub](https://hub.docker.com). +1. Select **My Hub**. +1. In the namespace drop-down, select your organization. +1. Select **Hardened Images** > **Manage**. + +When your subscription is in the EU region, the subscription label shows +**Your subscription (Region EU)**. When it shows only **Your subscription**, +your subscription is in the default US region. + +## What Docker stores in the EU + +When your subscription is in the EU region, Docker stores the following in the +EU: + +- The repositories that Docker creates when you [mirror a DHI + repository](../how-to/mirror.md) to your organization on Docker Hub, and + their attestations +- Your [customized images](../how-to/customize.md) and their attestations + +OCI artifacts that you use in customizations are stored in the region of the +repository that you push them to. To keep them in the EU, push them to +repositories in the EU region. + +Your region doesn't apply to repositories that you [mirror to a third-party +registry](../how-to/mirror.md#mirror-a-dhi-repository-to-a-third-party-registry). +Where that content is stored depends on the registry you use. + +## Attestations in the EU region + +Docker stores attestations with the images in your Docker Hub repository. For +mirrored repositories, Docker copies only the attestations created when the +image is built. Attestations that Docker Scout generates, such as VEX +statements and vulnerability reports, aren't available in the EU region. To +see which attestations are available, see [Image +attestations](./security-concepts/attestations.md#image-attestations). + +## Limitations in the EU region + +Mirroring and customization in the EU region work the same as in other regions, +with the following differences: + +- You can't [add files](../how-to/customize.md#inject-files-into-the-image) + that you write directly in a customization, such as configuration files or + setup scripts. This doesn't affect files that come from OCI artifacts. You can + still add packages, OCI artifacts, and symlinks. +- Docker doesn't provide VEX statements or vulnerability reports for your + mirrored repositories or customized images. +- Docker doesn't turn on Docker Scout image analysis for your mirrored + repositories or customized images in the EU region. If you turn on Docker + Scout image analysis for a repository in the EU region, the data that Docker + Scout processes is stored in the US. diff --git a/content/manuals/dhi/explore/security-concepts/attestations.md b/content/manuals/dhi/explore/security-concepts/attestations.md index 4686424631..0fde980e85 100644 --- a/content/manuals/dhi/explore/security-concepts/attestations.md +++ b/content/manuals/dhi/explore/security-concepts/attestations.md @@ -73,24 +73,29 @@ $ docker scout attest list dhi.io/: For more details, see [Verify image attestations](../../how-to/verify.md#verify-image-attestations). -| Attestation type | Description | -|----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| CycloneDX SBOM | A software bill of materials in [CycloneDX](https://cyclonedx.org/) format, listing components, libraries, and versions. | -| STIG scan | Results of a STIG scan, with output in HTML and XCCDF formats. | -| CVEs (In-Toto format) | A list of known vulnerabilities (CVEs) affecting the image's components, based on package and distribution scanning. | -| VEX | A [Vulnerability Exploitability eXchange (VEX)](https://openvex.dev/) document that identifies vulnerabilities that do not apply to the image and explains why (e.g., not reachable or not present). | -| Scout provenance | Provenance metadata generated by Docker Scout, including the source Git commit, build parameters, and environment details. | -| Scout SBOM | An SBOM generated and signed by Docker Scout, including additional Docker-specific metadata. | -| Secrets scan | Results of a scan for accidentally included secrets, such as credentials, tokens, or private keys. | -| Tests | A record of automated tests run against the image, such as functional checks or validation scripts. | -| Virus scan | Results of antivirus scans performed on the image layers. For details, see [Malware scanning](../malware-scanning.md). | -| CVEs (Scout format) | A vulnerability report generated by Docker Scout, listing known CVEs and severity data. | -| SLSA provenance | A standard [SLSA](https://slsa.dev/) provenance statement describing how the image was built, including build tool, parameters, and source. | -| SLSA verification summary | A summary attestation indicating the image's compliance with SLSA requirements. | -| SPDX SBOM | An SBOM in [SPDX](https://spdx.dev/) format, widely adopted in open-source ecosystems. | -| FIPS compliance | An attestation that verifies the image uses FIPS 140-validated cryptographic modules. | -| DHI Changelog | A record of changes made to the image across versions. | -| DHI Image Sources | Links to a corresponding source image containing all materials used to build the image, including package source code, Git repositories, and local files, ensuring compliance with open source license requirements. | +The **Available in the EU region** column applies only if your organization's +DHI subscription is in the EU region. It shows which attestations are available +for your mirrored repositories in that region. For details, see [EU data +residency](../eu-region.md#attestations-in-the-eu-region). + +| Attestation type | Description | Available in the EU region | +|----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------| +| CycloneDX SBOM | A software bill of materials in [CycloneDX](https://cyclonedx.org/) format, listing components, libraries, and versions. | No | +| STIG scan | Results of a STIG scan, with output in HTML and XCCDF formats. | Yes | +| CVEs (In-Toto format) | A list of known vulnerabilities (CVEs) affecting the image's components, based on package and distribution scanning. | No | +| VEX | A [Vulnerability Exploitability eXchange (VEX)](https://openvex.dev/) document that identifies vulnerabilities that do not apply to the image and explains why (e.g., not reachable or not present). | No | +| Scout provenance | Provenance metadata generated by Docker Scout, including the source Git commit, build parameters, and environment details. | No | +| Scout SBOM | An SBOM generated and signed by Docker Scout, including additional Docker-specific metadata. | No | +| Secrets scan | Results of a scan for accidentally included secrets, such as credentials, tokens, or private keys. | Yes | +| Tests | A record of automated tests run against the image, such as functional checks or validation scripts. | Yes | +| Virus scan | Results of antivirus scans performed on the image layers. For details, see [Malware scanning](../malware-scanning.md). | Yes | +| CVEs (Scout format) | A vulnerability report generated by Docker Scout, listing known CVEs and severity data. | No | +| SLSA provenance | A standard [SLSA](https://slsa.dev/) provenance statement describing how the image was built, including build tool, parameters, and source. | Yes | +| SLSA verification summary | A summary attestation indicating the image's compliance with SLSA requirements. | Yes | +| SPDX SBOM | An SBOM in [SPDX](https://spdx.dev/) format, widely adopted in open-source ecosystems. | Yes | +| FIPS compliance | An attestation that verifies the image uses FIPS 140-validated cryptographic modules. | Yes | +| DHI Changelog | A record of changes made to the image across versions. | Yes | +| DHI Image Sources | Links to a corresponding source image containing all materials used to build the image, including package source code, Git repositories, and local files, ensuring compliance with open source license requirements. | Yes | ## Package attestations @@ -123,18 +128,23 @@ $ docker scout attest list dhi.io/: For more details, see [Verify Helm chart attestations](../../how-to/verify.md#verify-helm-chart-attestations-with-docker-scout). -| Attestation type | Description | -|----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| CycloneDX SBOM | A software bill of materials in [CycloneDX](https://cyclonedx.org/) format, listing the chart itself and all container images and tools referenced by the chart. | -| CVEs (In-Toto format) | A list of known vulnerabilities (CVEs) affecting the container images and components referenced by the chart. | -| Scout provenance | Provenance metadata generated by Docker Scout, including the chart source repository, build images used, and build parameters. | -| Scout SBOM | An SBOM generated and signed by Docker Scout, including the chart and container images it references, with additional Docker-specific metadata. | -| Secrets scan | Results of a scan for accidentally included secrets, such as credentials, tokens, or private keys, in the chart package. | -| Tests | A record of automated tests run against the chart to validate functionality and compatibility with referenced images. | -| Virus scan | Results of antivirus scans performed on the chart package. For details, see [Malware scanning](../malware-scanning.md). | -| CVEs (Scout format) | A vulnerability report generated by Docker Scout, listing known CVEs and severity data for the chart's referenced images. | -| SLSA provenance | A standard [SLSA](https://slsa.dev/) provenance statement describing how the chart was built, including build tool, source repository, referenced images, and build materials. | -| SPDX SBOM | An SBOM in [SPDX](https://spdx.dev/) format, listing the chart and all container images and tools it references. | +The **Available in the EU region** column applies only if your organization's +DHI subscription is in the EU region. It shows which attestations are available +for your mirrored Helm charts in that region. For details, see [EU data +residency](../eu-region.md#attestations-in-the-eu-region). + +| Attestation type | Description | Available in the EU region | +|----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------| +| CycloneDX SBOM | A software bill of materials in [CycloneDX](https://cyclonedx.org/) format, listing the chart itself and all container images and tools referenced by the chart. | No | +| CVEs (In-Toto format) | A list of known vulnerabilities (CVEs) affecting the container images and components referenced by the chart. | No | +| Scout provenance | Provenance metadata generated by Docker Scout, including the chart source repository, build images used, and build parameters. | No | +| Scout SBOM | An SBOM generated and signed by Docker Scout, including the chart and container images it references, with additional Docker-specific metadata. | No | +| Secrets scan | Results of a scan for accidentally included secrets, such as credentials, tokens, or private keys, in the chart package. | Yes | +| Tests | A record of automated tests run against the chart to validate functionality and compatibility with referenced images. | Yes | +| Virus scan | Results of antivirus scans performed on the chart package. For details, see [Malware scanning](../malware-scanning.md). | Yes | +| CVEs (Scout format) | A vulnerability report generated by Docker Scout, listing known CVEs and severity data for the chart's referenced images. | No | +| SLSA provenance | A standard [SLSA](https://slsa.dev/) provenance statement describing how the chart was built, including build tool, source repository, referenced images, and build materials. | Yes | +| SPDX SBOM | An SBOM in [SPDX](https://spdx.dev/) format, listing the chart and all container images and tools it references. | Yes | ## View and verify attestations diff --git a/content/manuals/dhi/how-to/customize.md b/content/manuals/dhi/how-to/customize.md index ba47f52d46..687a638a72 100644 --- a/content/manuals/dhi/how-to/customize.md +++ b/content/manuals/dhi/how-to/customize.md @@ -104,18 +104,36 @@ You can create customizations using either the DHI CLI or the Docker Hub web int For more details, see [OCI artifacts](#oci-artifacts). - 1. In the **Scripts** section, you can add, edit, or remove scripts. + 1. In the **Files** section, you can add, edit, or remove files. - Scripts let you add files to the container image that you can access at runtime. They are not executed during - the build process. This is useful for services that require pre-start initialization, such as setup scripts or + Files let you add static content to the container image that you can + access at runtime, such as configuration files or setup scripts. Files + are not executed during the build process. This is useful for services + that require initialization before they start, such as setup scripts or file writes to directories like `/var/lock` or `/out`. You must specify the following: - - The path where the script will be placed - - The script content - - The UID and GID ownership of the script - - The octal file permissions of the script + - The path where the file will be placed + - The file content + - The UID and GID ownership of the file + - The octal file permissions of the file + + > [!NOTE] + > + > If your organization's DHI subscription is in the EU region, the + > **Add** option in the **Files** section is greyed out. File content + > isn't supported in the EU region. For details, see [EU data + > residency](../explore/eu-region.md). + + 1. In the **Symlinks** section, you can add, edit, or remove symbolic links. + + You must specify the following: + + - The path where the symlink will be placed + - The source path that the symlink points to + + Optionally, you can specify the UID and GID ownership of the symlink. 1. Select **Next: Configure** to configure the following image settings: @@ -380,6 +398,13 @@ paths: | `uid` | User ID of the file owner. | | `gid` | Group ID of the file owner. | +> [!NOTE] +> +> If your organization's DHI subscription is in the EU region, you can't add +> files with `contents` in the `paths` field. File content isn't supported in +> the EU region. For details, see [EU data +> residency](../explore/eu-region.md). + #### Configure user accounts To add users or groups to the image, or to change which user the container diff --git a/content/manuals/dhi/how-to/mirror.md b/content/manuals/dhi/how-to/mirror.md index 48a6077eea..3a48282069 100644 --- a/content/manuals/dhi/how-to/mirror.md +++ b/content/manuals/dhi/how-to/mirror.md @@ -175,6 +175,14 @@ other Docker Hub repository, so you can manage access and permissions, configure webhooks, and use other standard Hub features. See [Docker Hub repositories](/manuals/docker-hub/repos/_index.md) for details. +### Mirrors in the EU region + +If your organization's DHI subscription is in the EU region, Docker creates +your mirrored repositories on Docker Hub in the EU. Mirrors created before your +subscription moved to the EU region stay in their original region. For +details, including how to get a subscription in the EU region, see [EU data +residency](../explore/eu-region.md). + ### Stop mirroring a repository After you stop mirroring, the repository remains, but it no longer receives diff --git a/content/manuals/dhi/release-notes/platform.md b/content/manuals/dhi/release-notes/platform.md index b1c3d12db7..5164ff99e0 100644 --- a/content/manuals/dhi/release-notes/platform.md +++ b/content/manuals/dhi/release-notes/platform.md @@ -11,6 +11,15 @@ This page contains information about the new features, improvements, and changes in the Docker Hardened Images (DHI) platform. Release notes are aggregated by quarter and include only notable product changes. +## Q4 2026 + +New features and enhancements released in the fourth quarter of 2026. + +- EU data residency (early access): Docker can provision your DHI + subscription in the EU region. When your subscription is in the EU region, + Docker stores your mirrored and customized images in the EU. For more + information, see [EU data residency](../explore/eu-region.md). + ## Q3 2026 New features and enhancements released in the third quarter of 2026. diff --git a/content/manuals/subscription-billing/plans/dhi.md b/content/manuals/subscription-billing/plans/dhi.md index 26c2bbf4d8..862e8ad16a 100644 --- a/content/manuals/subscription-billing/plans/dhi.md +++ b/content/manuals/subscription-billing/plans/dhi.md @@ -33,6 +33,10 @@ DHI Enterprise extends DHI Select with unlimited customizations, optional full c For details on setting up and managing repositories, see [Get started with DHI Select and Enterprise](/manuals/dhi/how-to/select-enterprise.md). +> [!TIP] +> +> EU data residency is in early access. Docker can provision your organization's DHI subscription in the EU region. To request it, contact your Docker account representative or Docker sales. For details, see [EU data residency for Docker Hardened Images](/manuals/dhi/explore/eu-region.md). + ## Billing cycle DHI Select is an annual plan billed per repository from the date your plan starts. Repositories added mid-cycle are prorated for the remainder of the billing period. You can add more repositories to your DHI Select plan by going to **Active plans** in the billing portal. For steps, see [Manage plans](/manuals/subscription-billing/manage/plans.md#upgrade-plans). diff --git a/data/summary.yaml b/data/summary.yaml index 64bf2a1805..cae0e0b981 100644 --- a/data/summary.yaml +++ b/data/summary.yaml @@ -177,6 +177,9 @@ Docker Hardened Images: subscription: [Docker Hardened Images Select or Enterprise] Docker Hardened Images Enterprise: subscription: [Docker Hardened Images Enterprise] +Docker Hardened Images EU data residency: + availability: Early Access + subscription: [Docker Hardened Images Select or Enterprise] Docker Init: requires: Docker Desktop [4.27](/manuals/desktop/release-notes.md#4270) and later Docker Model Runner: