Docker Engine API adds image attestations endpoint
Introduced 2026-06-18 · score 0.94
HOW TO USE IT
When reviewing an image’s supply-chain metadata, call the Docker Engine API endpoint to retrieve its in-toto attestations. Set `statement=true` to include verbatim statement bodies; optionally select a platform or filter by predicate type.
curl --unix-socket /var/run/docker.sock 'http://localhost/v1.55/images/<image>/attestations?statement=true'WHY THIS HELPS
Retrieve in-toto attestation statements attached to an image when reviewing its supply-chain metadata.
REQUIREMENTS AND LIMITATIONS
- Version: 29.6.0
- name (required): Image name or ID in the endpoint path.
- platform: JSON-encoded OCI platform selecting the image variant; defaults to the daemon’s host platform. Repeatable in the API declaration, but only one value is currently accepted.
- type: In-toto predicate type URI filter. May be repeated; if omitted, all statements are returned.
- statement: Boolean, default `false`. When true, include each verbatim in-toto statement body; otherwise return only its descriptor and predicate type without reading statement blobs.
- Prerequisite: Use Engine API v1.55 or later; the endpoint was added in v1.55.
- Prerequisite: The legacy graphdriver image store does not support attestations and returns HTTP 501.
- Statements include examples such as SLSA provenance and SPDX SBOM.
FIRST-PARTY EVIDENCE
- https://github.com/moby/moby/releases/tag/docker-v29.6.0
- https://docs.docker.com/reference/api/engine/
- https://docs.docker.com/reference/api/engine/version/v1.56/
- https://github.com/moby/moby/blob/docker-v29.6.0/api/docs/CHANGELOG.md
Check the installed version and the source before using it. Entry JSON