dhi.io/gitlab-runner
GitLab Runner 19.x (dev)
19-debian-dev, 19-debian13-dev, 19-dev, 19.5-debian-dev, 19.5-debian13-dev, 19.5-dev, 19.5.2-debian-dev, 19.5.2-debian13-dev, 19.5.2-dev
sha256:e8e83b1e6f9ec76db41236baf1df793b05cb1b63734656bc5d8629f1bf2e9258
Manifest digest:sha256:43ff60531cc91c32aedd9a6c57aec9e8eef37b3188620c5f5fbb68aa0b0d1937
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:9e6889dadbab03635fdc6ef3b2587e0b7cae9ee6439ba637cc6799e582047f19 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:982d4962e22b71a2692984e122cb24e672ec954e8617be2515dc265a3de6546c |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:ac08f9977e839c89c52d24219e6831f1959c23a629cf86dbb8f1ec4b18c0a266 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:0254fcb54971996fdde423e1226223f0f8a120c970dd3a7a4cf1ca41c22646fc |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:e3ce6adc9b9cde80db7d50f8cb5d840f58786464a426ec50f29ebe1c9c9d39c6 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:988f3507fb654e1130928fb575393f4bf4a92361784194d37bb49a673c4457e8 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:efd2ddd10e2fa7913316b7db33db68b4dfbc224e5e0094b10c5a14e3ef3463e3 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:2a0f556196b5c3ad1dcd6a39e74b5b799eeacdda62265079d3a880c87feb3bb0 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:e14e304d758754e35a5f093b3dfd601d3553e620508f17414f2c30f9b84275bb |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:fae38ec6af881ca94c289f566da138561bf8d5069b1c4388b32c08279cb4cd4e |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:b9bb9ff23cf3714c8b29de6c07253b1ab26ac0fb6afa49a1056d921609a0863a |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:ed7945cc7363e2ef8119aba8ae40227fa19060cdb761de33a0889062d914e749 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:62679dcf60e865997e831d0b9e4ad52b1308c51fcf8b4b059210e78ef6ec5b24 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:05ac1ee4564208b03686621b8b327414cf6a63a0264e3612a9d4eadf54f5f410 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:0f92711592b92348315b0a3834d09ba3d97b31753e8526fa1ba9ee6ba402c997 |