dhi.io/gitlab-runner
GitLab Runner 19.x (dev)
19-debian-dev, 19-debian13-dev, 19-dev, 19.5-debian-dev, 19.5-debian13-dev, 19.5-dev, 19.5.2-debian-dev, 19.5.2-debian13-dev, 19.5.2-dev
sha256:399172879ae4eb8c883097d5735ec58605b55f7261959c6971ab17607367dba0
Manifest digest:sha256:d0a5956b434f8586caaaedaa5201f9f56bc67519454b18ea5dfd76c4b220afaf
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:3b83ecc79d074b79801a22cbb1ac4982fe91ce9a81e93d5d01d121087139dd47 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:20f7b9262c2e18447ba64d0df039f551c9c82528f9de922b3aa977b1661d4317 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:542c97e0b72eb12fa930e273d3b14ac9282321108782e54d76e43fde3ac86d87 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:f507424e7447fb4662d6defa0e3ddff5e4ce830c1a499516e8db3d53c4a9972f |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:03db678775ec2388f80dcea52a40c6565395d8dd5d8dd4573258acfd6479bb14 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:276a36417a4d5411feacc25814252e52a0671d8b8698f35a646c2e7358deeb83 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:e762070b0b893caebed6a20e2d6cea0cb2e66a7771810d2dac14d5ddbb4ceb4b |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:0e5036c470dba287d3339972fe55312e056d6a38553ac1c88610a3fb39de8968 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:3c2e240da5f39bed7db311554169b7fc95acbce5728903ed02153d01b1112a55 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:92fca05a905c2170fbc5d8dfdd77314bcc3727d59b452df6832f348fce4c7f52 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:e5cd4378e455d65a2eac5c966fa92efd2220aa331b84dd1adf46e42abc8bb24a |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:ab841e681b083c015b24b94e6ec7a0f5157cc1d587e9166a3bcc3272acb369aa |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:7b476de6fbb7aa37f3cfdfbdcc9133193800d3429e33732d13b2af2bf5d468f0 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:1f083cf5f717409155155e769e234261eacfc77efa671f71e41874d85af0e32e |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:1df6b726b52951f58a0aed7e52914b32bdef083a5d9175b5854347d7e2e1101c |