policy.json is a JSON configuration file that defines image trust and signature-verification policies for container image operations.
policy.json is a JSON configuration file that defines which container image registries and repositories Podman trusts during image operations. It belongs to the containers/image configuration alongside registries.conf. section 5.2section 5.5
Define trust rules by scope and trust type:
Evaluate scopes from the most specific image or repository to the broadest registry, then fall back to the default policy. section 11.3
Use accept to allow pulls, reject to block them, or signBy to require signatures from a specified identity. section 11.3
Store the system policy at /etc/containers/policy.json; configure it with podman image trust, which must run as root. section 11.3
Reject a registry while allowing a repository
sudo podman image trust set -t reject docker.io
sudo podman image trust set -t accept docker.io/library
podman pull alpine
The registry-wide rejection is overridden for docker.io/library because the repository rule is more specific.
How Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more covers it
How deep it goes
Explains file location, scope precedence, trust types, and commands, but does not detail JSON schema internals.
Examples
Demonstrates rejecting docker.io, allowing docker.io/library, inspecting trust settings, and requiring signed images.
What it assumes
Assumes basic Podman image-pull knowledge and introduces registry hosts, transports, repositories, and trust scopes.
What you can do after
Operate/configure registry access and verify effective trust rules with podman image trust.
How it connects
Connects Podman with containers/image, container registries, image signatures, and registries.conf.
container image trustconfigures · Container image trust is the verification and policy-based acceptance of container images before they are used.
signature verificationconfigures · Signature verification is the cryptographic process of checking a digital signature against data and a corresponding public key to determine whether it is valid.
This explainer was generated by Manning's knowledge graph from the text of Podman in Action: Secure, rootless containers for Kubernetes, microservices, and more. The section links point to the parts of the book it draws on.
