dhi.io/gitlab-runner
GitLab Runner 19.x (dev)
19-debian-dev, 19-debian13-dev, 19-dev, 19.5-debian-dev, 19.5-debian13-dev, 19.5-dev, 19.5.0-debian-dev, 19.5.0-debian13-dev, 19.5.0-dev
sha256:d6e523b234ba464131a37bf862c2d25b2bf0c0cd9a2903c7626e2bac8344bc9e
Manifest digest:sha256:eddef5d0057e3525e73d0d3a8bf942d3a7cca149afb2cecc7a65f5ecae1f2f20
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:47a4f06cc5e475dda88a7de1aa25fdd24304939e04677e1ad09621acd19329c3 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:b05c955441d51e7a1381ecdee341df10db4a08ccb480ae0997ec15743cfcb121 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:ec32639e06aa7d4f91b2b53ea43657455181cecc212f5af45e4e8022c5137aac |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:8367f936013e64a2dfe98458d1fb18318db830d72fdc6709ae2423ce5341843d |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:ca5ce311a87648d9b0eaf6f319107c4d96cf5858cea75d35794ac285971fe438 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:ac1af4b3473acbf38ae2ee153a7bb54c209f449acc2f065292fe0d8f3eda35ba |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:c07f892fffb4539dcea9a096a47c76143e0b22b05419933787d44d56fa1d97dd |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:2316ee6441af1898dde3197ea8d3f34f5f03f740b8822ec1bd15d2d04ddec6ac |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:897569ad95b2fbb89da87752eb28b17b2ba9a814dc034918b918ea48f45296f2 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:d041fe722cb3c3014dc4a807908a7976e2c8d596537106f3b33b7b74d5af750d |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:f6f71deeee3489d549cb92dd6eddc3810802f210d720a25ff76b0fb037f30ba0 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:22bbedc68a202bb5798e8902c4c7e5e36420646fb1f417953fe813d1e3b8829d |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:0cb866ae0d2a921bed4b89fdea67e688328f9dc81050ed4216244175577554ee |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:e016527a21bf3b87e6381df7504f5aa38b9cfdc539cb495c4c899abd30b73854 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:2e3f194ff6b4f33206108bf730c249d9b32242cac97a25f6c679eac4d2cb95a0 |