Manage applications

Estimated reading time: 2 minutes

This topic applies to Docker Enterprise.

The Docker Enterprise platform business, including products, customers, and employees, has been acquired by Mirantis, inc., effective 13-November-2019. For more information on the acquisition and how it may affect you and your business, refer to the Docker Enterprise Customer FAQ.

With the introduction of the experimental app plugin to the Docker CLI, DTR has been enhanced to include application management. In DTR 2.7, you can push an app to your DTR repository and have an application be clearly distinguished from individual and multi-architecture container images, as well as plugins. When you push an application to DTR, you see two image tags:

Image Tag Type Under the hood
Invocation <app_tag>-invoc Container image represented by OS and architecture (e.g. linux amd64) Uses Docker Engine. The Docker daemon is responsible for building and pushing the image.
Application with bundled components <app_tag> Application Uses the app client to build and push the image. docker app is experimental on the Docker client.

Notice the app-specific tags, app and app-invoc, with scan results for the bundled components in the former and the invocation image in the latter. To view the scanning results for the bundled components, click “View Details” next to the app tag.

Click on the image name or digest to see the vulnerabilities for that specific image.

Parity with existing repository and image features

The following repository and image management events also apply to applications:


  • You cannot sign an application since the Notary signer cannot sign OCI (Open Container Initiative) indices.
  • Scanning-based policies do not take effect until after all images bundled in the application have been scanned.
  • Docker Content Trust (DCT) does not work for applications and multi-arch images, which are the same under the hood.

Troubleshooting tips

x509 certificate errors

fixing up "" for push: failed to resolve "", push the image to the registry before pushing the bundle: failed to do request: Head x509: certificate signed by unknown authority


Check that your DTR has been configured with your TLS certificate’s Fully Qualified Domain Name (FQDN). See Configure DTR for more details. For docker app testing purposes, you can pass the --insecure-registries option for pushing an application`.

docker app push hello-world --tag --insecure-registries
Successfully pushed bundle to Digest is sha256:bd1a813b6301939fa46e617f96711e0cca1e4065d2d724eb86abde6ef7b18e23.

Known Issues

See DTR 2.7 Release Notes - Known Issues for known issues related to applications in DTR.

DTR, trusted registry, Docker apps