dhi.io/gitlab-runner
GitLab Runner 18.x (fips)
18-debian-fips, 18-debian13-fips, 18-fips, 18.11-debian-fips, 18.11-debian13-fips, 18.11-fips, 18.11.4-debian-fips, 18.11.4-debian13-fips, 18.11.4-fips
sha256:475c40329f94053b50f01943334375c6dba6b253bf2468360c097a65a758cddb
Manifest digest:sha256:e2b5dbffec1ab10b2fdb8abe5427bfbc7d5f71e273d8123521793ed0be525a11
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:18-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:92a11edb2e65a9e51ab9d00ae6ec47cb7ae3ea4902c83baba329f3faf7c3a929 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:56d29731da92ff33f5943028709dd6187384be12bd8aeab32e8f29d9cb6584f5 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:bcda958eb14eb7152ee790d2f50373dc4bbce07917c99f7b6693b77cb6f74a3f |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:85b4c6b6850af17e44e05d1a9ff8735c40396287aa12be388e41d03a6ec74753 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:5ec5dde5b748cba1572750308e23bbd86e86fe42bc05e650725f84a7558653d4 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:4abcddc91fc8c2bd84448ebbec566fad40e95fea2c242818b9906d44a16f8d6b |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:d0f513e82c4e6be0718da67bbe567981638d59c7fe881391d2633f5110945c4f |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:f7e11effb5a9710afbf1ec31cfd2dbe9d0955e6303e62e830cd174e6f4de2e61 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:d4893eaf841811eeb16d6e29bf4b505b573e03bd5658fae2880b7b1e66e3b8c8 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:c7f06c81fd2ebbd6826816e15ab9f39c5d85da1c8d9deb7718f638532f85873e |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:0c8280f508fa1d2e9d13f711eb81c6120144f6cfe92c8cc6c6e39e823069c261 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:3a9d797707d2f91b99c3317856f283fc3ac79ea7445580350904deff5a70f81f |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:f7e458dfd407f7b7d822113eb31597b8b60c8912ccc0042f7a624144c60083d8 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:c9a5926621d7a05aaeedcfeb3bdc3141d02e5e42aa3ab91d2748130cc1228308 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:0c81298fa718be361d57c08ea70beb9bfc7eb5ba4def8845d96e87ed928430ee |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:0c4ec7c970fa2a4835d66f4762bb392af5f6cf91dcbf84f8e44c297f82771ddc |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:91c245d2e092658ba005f783c3d7b9f4e4d17b9fb246e77f12533345b5215147 |