{
  "slug": "docker-engine-api-adds-image-attestations-endpoint-49ef666c5907",
  "title": "Docker Engine API adds image attestations endpoint",
  "tools": [
    "docker"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-06-18T20:43:10.000Z",
  "announced_at": "2026-06-18T20:43:10.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When reviewing an image’s supply-chain metadata, call the Docker Engine API endpoint to retrieve its in-toto attestations. Set `statement=true` to include verbatim statement bodies; optionally select a platform or filter by predicate type.",
    "examples": [
      "curl --unix-socket /var/run/docker.sock 'http://localhost/v1.55/images/<image>/attestations?statement=true'"
    ],
    "gotchas": [
      "Version: 29.6.0",
      "name (required): Image name or ID in the endpoint path.",
      "platform: JSON-encoded OCI platform selecting the image variant; defaults to the daemon’s host platform. Repeatable in the API declaration, but only one value is currently accepted.",
      "type: In-toto predicate type URI filter. May be repeated; if omitted, all statements are returned.",
      "statement: Boolean, default `false`. When true, include each verbatim in-toto statement body; otherwise return only its descriptor and predicate type without reading statement blobs.",
      "Prerequisite: Use Engine API v1.55 or later; the endpoint was added in v1.55.",
      "Prerequisite: The legacy graphdriver image store does not support attestations and returns HTTP 501.",
      "Statements include examples such as SLSA provenance and SPDX SBOM."
    ]
  },
  "why_it_matters": "Retrieve in-toto attestation statements attached to an image when reviewing its supply-chain metadata.",
  "sources": [
    "https://github.com/moby/moby/releases/tag/docker-v29.6.0",
    "https://docs.docker.com/reference/api/engine/",
    "https://docs.docker.com/reference/api/engine/version/v1.56/",
    "https://github.com/moby/moby/blob/docker-v29.6.0/api/docs/CHANGELOG.md"
  ],
  "rank": 0.94029,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1b-tools-20261017",
    "verdict_id": "wave1b-tools-20261017:wave1b-tools-20261017-505a73658c707d83-1:gate",
    "evidence_hash": "06e30a70bd4ea8c6df8b6e240383f2be6a1e700e76fedb30734c31976b728726"
  },
  "review": {
    "draft_hash": "db16b574ac726e4a48cd1cd9d0a817f5de3d71fdc555167083db7abf2a73ac74",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1b-tools-20261017:gate",
    "reason": "2 of 3 judge runs approved with p_yes >= 0.9 (mean 0.94 >= 0.9; 2 needed) and Jev gave 0.61 (>= 0.6 needed)."
  }
}