Image trust is the confidence that a container image was built by the expected source and has not been altered in transit or storage. In practice, it means knowing where the image came from, who signed or published it, and whether the contents match what your team intended to run.
This matters because a container image can carry application code, startup scripts, configuration, and even malware. Attackers may publish lookalike images, compromise a build pipeline, or swap tags so a trusted name points to an untrusted payload. Defenders reduce this risk by using private registries, verifying signatures or digests, pinning versions, scanning images before deployment, and limiting who can push or pull them. On developer endpoints and WSL-based setups, image trust is part of workstation security, not just server security, because a bad image can reach local files, secrets, and internal networks if permissions are too broad.