dhi.io/gitlab-runner
GitLab Runner 18.x
18, 18-debian, 18-debian13, 18.11, 18.11-debian, 18.11-debian13, 18.11.4, 18.11.4-debian, 18.11.4-debian13
sha256:5879366e7e7f1e67f22520f48518e7f77015755ccbe4c63f607773352774bcd5
Manifest digest:sha256:d376783c2a3c8d544c8471abfb206b83cecae8ada68121cfc35f82e722703b43
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:182. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:ad61b8a8e79d38a43e30130bb81dc77156d4a49ad51e0581d4e07d1f77b3960c |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:297d06761903e9e7facd60f84767065df9102cd4ceebfae032de922243d282e8 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:2661285096ec165715ea108ed6b95654518091da665ff6b555a4d3b9950607a7 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:901fa661409c8910e1869322fe1bd36d05cb1a3ade6b5989b9f15b8199f81bdf |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:01313877d9c4f582a0bce32f2c93d89b017bce127bb4ddc9cf85679aedf7711e |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:fe58cca1e4dd5d52afac61752d067c3b9a8a6a9603d6e0c7d2510232ab732f19 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:9e94c5857c615cc512cede2fd74c23b59e21ffffd41a8150bb86387f45aeec5f |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:c9aea2a401af71963281d744c34c91f62dce3545aa51f6627cb22b1a12a2fbfa |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:68634d0db65ba5562891b59a6c513bf5f5380245d670f0618476f1c2627d4448 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:48f7074bc460af671322035e6d0dd62313896e2e87517ddcd59a31394278263c |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:524e58f8835ce7314c34b351c33867dd8c797db5910b8581a4c4ceb3ae5c721d |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:1b1b4add192a8c47cf5865a16fa8e8570b00262beca0e78d6e0b37a61a866d7d |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:ba9dd354f8c152773b94be412b66a15a5528eda0e312d0ee75875fee5100986a |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:e3be2b7975b8e763852cc475bf908dbc582bd0f74085009daa4174fe626d05c4 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:18dd39573705a76372bcb9af81ed5ca3cf5ece114569637d490504376c42d580 |