<p>At first glance, it seems that tag immutability is not a feature provided by Quay. You can enable &quot;Trust and Signing&quot; in the &quot;settings&quot; of the repo:</p>
<blockquote>
<p>Please note that this will not prevent users from overwriting signed tags without updating signatures. This means that:</p>
<ul>
<li>Any tag operations in the UI or client can cause inconsistency</li>
<li>Builds should not push to signed tags</li>
</ul>
<p>We recommend you maintain a strict separation between signed and unsigned tags to avoid any issues with garbage collection.</p>
</blockquote>
<p>So, you can sign tags, but you can't prevent them from being updated.</p>

CC BY-SA 4.0
2019-11-06T11:15:45.033Z
2019-11-06T11:15:45.033Z
2020-06-18T08:28:10.803Z
Bruce Becker
<p>Elastic Container Registry (ECR) for example supports Tag Immutability (TI). TI implies that docker tags cannot be overwritten if they exist in a docker-registry.</p>

<p>The settings of the organization and the ones from a repository were inspected, but no TI setting was found.</p>

<p><strong>Questions</strong></p>

<ul>
<li>Does quay support TI?</li>
<li>If true, how to enable it</li>
<li>If false, how do you or does your organization prevent that tag overwrite takes place?</li>
</ul>

<docker><docker-registry><quay.io><dip>
How to enable tag immutability in quay.io?
030
# How to enable tag immutability in quay.io?

(Asked by: username_0 on 2019-11-06)

Elastic Container Registry (ECR) for example supports Tag Immutability (TI). TI implies that docker tags cannot be overwritten if they exist in a docker-registry.

The settings of the organization and the ones from a repository were inspected, but no TI setting was found.

**Questions**

* Does quay support TI?
* If true, how to enable it
* If false, how do you or does your organization prevent that tag overwrite takes place?

**Tags:** docker, docker-registry, quay.io, dip


---

## 1 answers

### Answer by username_1 on 2019-11-06. Score: 3 | Accepted answer

At first glance, it seems that tag immutability is not a feature provided by Quay. You can enable "Trust and Signing" in the "settings" of the repo:

> Please note that this will not prevent users from overwriting signed tags without updating signatures. This means that:
>
> * Any tag operations in the UI or client can cause inconsistency
> * Builds should not push to signed tags
>
> We recommend you maintain a strict separation between signed and unsigned tags to avoid any issues with garbage collection.

So, you can sign tags, but you can't prevent them from being updated.


---

