error: no trust data available for remote repository

Error message

error: no trust data available for remote repository %s. Try running notary server and setting DOCKER_CONTENT_TRUST_SERVER to its HTTPS address

What it means

Returned by NotaryError (trust.go:236) when the underlying notary error is a *json.SyntaxError, meaning the trust server returned data that is not valid JSON. The message tells the user no trust data exists for the repository and suggests running a Notary server and setting DOCKER_CONTENT_TRUST_SERVER to its HTTPS address.

Solutions

Confirm the image is signed; if not, either sign it or disable trust for that pull (unset DOCKER_CONTENT_TRUST).
Verify DOCKER_CONTENT_TRUST_SERVER resolves to a running Notary server returning JSON (curl the /v2/ endpoint).
Initialize trust for the repo: push with DOCKER_CONTENT_TRUST=1 after `docker trust key generate` / `docker trust signer add`.
Check for corporate proxies intercepting and rewriting the response.

Example fix

# before: trust enabled against an unsigned/unreachable repo
DOCKER_CONTENT_TRUST=1 docker pull example.com/app:latest

# after: verify the notary endpoint, or pull without trust
curl -s https://notary.example.com/v2/example.com/app/_trust/t targets.json | head
# if unsigned: 
DOCKER_CONTENT_TRUST= docker pull example.com/app:latest

Defensive patterns

Strategy: fallback

Validate before calling

// Probe the notary endpoint before trusting it
resp, err := http.Get(strings.TrimRight(trustServer, "/") + "/v2/")
if err != nil || resp.StatusCode >= 400 {
    return fmt.Errorf("trust server unreachable or not returning JSON; disable trust or fix server")
}

Try / catch

// If no trust data, fall back to a non-trusted pull (only if policy allows)
if err := trustedPull(img); err != nil {
    if strings.Contains(err.Error(), "no trust data available") {
        return untrustedPull(img)
    }
    return err
}

Prevention

Initialize/sign repos before requiring trust on pull.
Point DOCKER_CONTENT_TRUST_SERVER at a real Notary server returning JSON.
Watch for proxies returning HTML error pages.

When it happens

Trigger: Performing a trusted pull/inspect on a repository that has never been initialized for content trust, or pointing DOCKER_CONTENT_TRUST_SERVER at an endpoint that returns non-JSON (an HTML error page, an empty body, a proxy intercept). notary client's JSON decode fails with a SyntaxError which NotaryError maps to this message.

Common situations: First pull of an unsigned image with DOCKER_CONTENT_TRUST=1, a misconfigured trust server URL hitting a generic web server, or DNS/proxy returning an HTML 502 page instead of trust metadata.

Related errors

AI-assisted analysis of docker/cli@4f84911bfe (2026-08-07). Data as JSON: /api/errors/45f4502b5815200f. Report an issue: GitHub.

Appendix: source

Thrown at cmd/docker-trust/internal/trust/trust.go:236

	return func(keyName string, alias string, createNew bool, numAttempts int) (string, bool, error) {
		if v := env[alias]; v != "" {
			return v, numAttempts > 1, nil
		}
		// For non-root roles, we can also try the "default" alias if it is specified
		if v := env["default"]; v != "" && alias != data.CanonicalRootRole.String() {
			return v, numAttempts > 1, nil
		}
		return baseRetriever(keyName, alias, createNew, numAttempts)
	}
}

// NotaryError formats an error message received from the notary service
func NotaryError(repoName string, err error) error {
	switch err.(type) {
	case *json.SyntaxError:
		logrus.Debugf("Notary syntax error: %s", err)
		return fmt.Errorf("error: no trust data available for remote repository %s. Try running notary server and setting DOCKER_CONTENT_TRUST_SERVER to its HTTPS address", repoName)
	case signed.ErrExpired:
		return fmt.Errorf("error: remote repository %s out-of-date: %v", repoName, err)
	case trustmanager.ErrKeyNotFound:
		return fmt.Errorf("error: signing keys for remote repository %s not found: %v", repoName, err)
	case storage.NetworkError:
		return fmt.Errorf("error: error contacting notary server: %v", err)
	case storage.ErrMetaNotFound:
		return fmt.Errorf("error: trust data missing for remote repository %s or remote repository not found: %v", repoName, err)
	case trustpinning.ErrRootRotationFail, trustpinning.ErrValidationFail, signed.ErrInvalidKeyType:
		return fmt.Errorf("warning: potential malicious behavior - trust data mismatch for remote repository %s: %v", repoName, err)
	case signed.ErrNoKeys:
		return fmt.Errorf("error: could not find signing keys for remote repository %s, or could not decrypt signing key: %v", repoName, err)
	case signed.ErrLowVersion:
		return fmt.Errorf("warning: potential malicious behavior - trust data version is lower than expected for remote repository %s: %v", repoName, err)
	case signed.ErrRoleThreshold:
		return fmt.Errorf("warning: potential malicious behavior - trust data has insufficient signatures for remote repository %s: %v", repoName, err)
	case client.ErrRepositoryNotExist:
		return fmt.Errorf("error: remote trust data does not exist for %s: %v", repoName, err)

View on GitHub (pinned to 4f84911bfe)