<commit_before>---
title: Configure your Notary client
description: Learn how to configure your Notary client to push and pull images from Docker Trusted Registry.
keywords: docker, registry, notary, trust
---

The Docker CLI client makes it easy to sign images but to streamline that
process it generates a set of private and public keys that are not tied
to your UCP account. This means that you can push and sign images to
DTR, but UCP doesn't trust those images since it doesn't know anything about
the keys you're using.

So before signing and pushing images to DTR you should:

* Configure the Notary CLI client
* Import your UCP private keys to the Notary client

This allows you to  start signing images with the private keys in your UCP
client bundle, that UCP can trace back to your user account.

## Download the Notary CLI client

If you're using Docker for Mac or Docker for Windows, you already have the
`notary` command installed.

If you're running Docker on a Linux distribution, you can [download the
latest version](https://github.com/docker/notary/releases). As an example:

```bash
# Get the latest binary
curl -L <download-url> -o notary

# Make it executable
chmod +x notary

# Move it to a location in your path
sudo mv notary /usr/bin/
```

## Configure the Notary CLI client

Before you use the Notary CLI client, you need to configure it to make it
talk with the Notary server that's part of DTR.

There's two ways to do this, either by passing flags to the notary command,
or using a configuration file.

### With flags

Run the Notary command with:<commit_msg>Update configure-your-notary-client.md<commit_after>---
title: Configure your Notary client
description: Learn how to configure your Notary client to push and pull images from Docker Trusted Registry.
keywords: docker, registry, notary, trust
---

The Docker CLI client makes it easy to sign images but to streamline that
process it generates a set of private and public keys that are not tied
to your UCP account. This means that you can push and sign images to
DTR, but UCP doesn't trust those images since it doesn't know anything about
the keys you're using.

So before signing and pushing images to DTR you should:

* Configure the Notary CLI client
* Import your UCP private keys to the Notary client

This allows you to  start signing images with the private keys in your UCP
client bundle, that UCP can trace back to your user account.

## Download the Notary CLI client

If you're using Docker Desktop for Mac or Docker Desktop for Windows, you already have the
`notary` command installed.

If you're running Docker on a Linux distribution, you can [download the
latest version](https://github.com/docker/notary/releases). As an example:

```bash
# Get the latest binary
curl -L <download-url> -o notary

# Make it executable
chmod +x notary

# Move it to a location in your path
sudo mv notary /usr/bin/
```

## Configure the Notary CLI client

Before you use the Notary CLI client, you need to configure it to make it
talk with the Notary server that's part of DTR.

There's two ways to do this, either by passing flags to the notary command,
or using a configuration file.

### With flags

Run the Notary command with:
{'fraction_non_alphanumeric': 0.050947499223361295, 'fraction_numerical': 0.0, 'mean_word_length': 4.143769968051118, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 6, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '984134', 'n_tokens_mistral': 903, 'n_tokens_neox': 842, 'n_words': 518}