dhi.io/gitlab-runner
GitLab Runner 18.x (fips)
18-debian-fips, 18-debian13-fips, 18-fips, 18.11-debian-fips, 18.11-debian13-fips, 18.11-fips, 18.11.4-debian-fips, 18.11.4-debian13-fips, 18.11.4-fips
sha256:10af266209b6b7ab8cb6d08f29d418e73cf4433e04eae0c84b615de8513025e8
Manifest digest:sha256:e158cff3494d036400a2fa68e74e1cfb243ca5a274efc828691c2752e498f04b
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:18-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:40b343ac20a9ce9f30185e1acc1cec07cb7d338a4d9e5a1f108ab06865e6a90d |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:a364475de5624446542225d5083a485f31749a56674ea71e535d4a9a4a8d3b57 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:8aefb26ea8daf8eebc218b1901baa5ba499e4b8f311461d555cf2635ba9e6360 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:800f1080c02bc52b60feb836dfba3e758dd0bd207fb886d490742b05b3711fa6 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:b30402bcd314d13de087f3165fa19bca4c4b9fcad4ba0be8cd6b82825d05d492 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:15599ca79579e39c4d253f303498e54e3216fb7497a3ada21e19261bc06eac29 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:795adf14732dc1fe5a7461147ff36a1bae5a6fe6a8587b53d602240095f38b9e |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:070adf742fbf1f8803702bfb6ba0553692906bf3838002ba33bb70a56d6e9621 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:d2e1ffe216f2eb1bc944a876dbc0afe03711186cd2f60f2df20ae9cce39aa95c |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:6d13eaf14ffbbf4628bb565aa20a6d54848892b3379016cdf5e778dbae38cee9 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:2005440ec6ebfe110042b590c3d6196e22efea9a2abdda7bf61aeab8609cef9d |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:385132706f369774b742158d4b4b41e23f61d45f9bffb26143eead37bac054ff |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:c5ddba0510ea43d936b2b48b88684c4eb7f1d0b795285ff345a67527172a254b |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:0abde5457a6d25f77b5dd7589e1c4c6c4abb6db9007bd4551538385b40cacf2e |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:3d22888fcc09af0c87553e61a42ce3d2f9abe21574b315ad7b9a48ae9a152cf6 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:8f69e5b98e03aa9c6ec976d2932a81320d3cf53c093ea676d599a157b06ea359 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:98788825d723a293702f6814626284083da40ac3120ae51e007c566bf4cb2602 |