Docker Hub's Notary service is being retired, and now produces failures in most cases. Add a warning when attempting to use it, pending full removal of trust; https://www.docker.com/blog/retiring-docker-content-trust/ With this PR: DOCKER_CONTENT_TRUST=1 docker pull -q hello-world WARNING: Docker is retiring DCT for Docker Official Images (DOI). For details, refer to https://docs.docker.com/go/dct-deprecation/ could not validate the path to a trusted root: unable to retrieve valid leaf certificates Signed-off-by: Sebastiaan van Stijn <github@gone.nl>