dhi.io/gitlab-runner
GitLab Runner 18.x
18, 18-debian, 18-debian13, 18.11, 18.11-debian, 18.11-debian13, 18.11.4, 18.11.4-debian, 18.11.4-debian13
sha256:c564d9854f30a21129720459cd746122c0539c1fcd1202216c16fa9949a38be6
Manifest digest:sha256:12f15eae0e9cc848f45925393fca1cb937c7d1f426c0b030edc21c14dca4d670
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:182. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:8148ad190f0c7bfedea2a1eb8334bcc96c2052fd627fbe9a024df2ea675d4f53 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:fdcfc56cbd1553115b4ef8ce0fef95a007192c1f65f57928d7b84d42406e0bac |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:c822b9b201a48eeaac97a77c64a0868a0ea7d5cee38bd6fcd22d09bd69a1cda6 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:89753d2f66a006c6d890df74b13df979b013402cf15dc0294f10c12cb29bfea4 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:4f4ca08a3421ca7a83e6ddb7916dc3f7170785f674476ed36c0bf30af5a2c025 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:f3b7c341cd82d4bf44a84c2e93c8d4f043d09a1e9f23143acfac36e782e45daf |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:cb1af62cc3d285c34dbade5de70f36fe8f071df165e1a3af887af0b7c56b2203 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:538f8c7c8eeb4f388f7e42300b0e32987d7373b687cf4cbc437b76c7aa5f3182 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:ffe36518982f713189d576f84675feae3d3961db29b1fc94691188a845e27a2f |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:47be67d81c0f71e798fb8a33eb91189956bc8e2c9df2850d45e4813ec966ce7d |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:cfb56b48d6e24ffe602c580ca51676e06480335ca2a8b7811923e2845d8a56a2 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:0d2fe3520c834ed2ca5c9cef18671bbf5f735d8b4486c92d56cc359f8a666db1 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:ef3e1b1ff6d0f8da62dd595994925d69422cb9bbe5e468c9b610c955ba3289e3 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:3e1221d2507bd90a2837ac09cb2788511ba2b0f179253623b43a30675ac46b74 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:f24dd0ed273c3b69d700d5c096b94f7dd4e6c90cfd598ff5fa39fcde4a40b583 |