dhi.io/gitlab-runner
GitLab Runner 19.x (dev)
19-debian-dev, 19-debian13-dev, 19-dev, 19.5-debian-dev, 19.5-debian13-dev, 19.5-dev, 19.5.2-debian-dev, 19.5.2-debian13-dev, 19.5.2-dev
sha256:83d71f4fa83908f809e5ff19bd3b771f5da15a3ea07e6d23081af5fdad38a823
Manifest digest:sha256:fe4cfad59e59b3096087ffaddfba35f838e5067d98aabf10518ada402d7f7777
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:43fca9f1911a4ca3c0888bb5ea9aefdd1eaa6351544b4e1e6cc20c08d8d2c065 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:6087f1fc873435a496375b4b507f45928eff3ab692278fd9a0766dec6f3b6cea |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:5a9515202a8aaf58d7d4bdb195e34fa0bcb837bac8028cb51652efdaa1640605 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:ca32e4535810f17c9895e597186d8dfa74eaf2ca9f657164d0410c9fad53a1f0 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:3e1059dd090263860e5a1c12df4ae23e60fee18d9fd7f6dc3eb078b5570a8a09 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:197c7789b297d135d376cc3d490910d19c15e5f7c5360f12ac8cd1ad5d731504 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:b9164cd7e29d324a85b521832534949a721d0cf08645dd5ab5614c0912aba3aa |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:37f8ff4e92bbac346664d1d18376b1ed41773b5a52ef54a5722c426eb95006cd |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:0f0e235d04cf8a3d29647dd6c3e95cc7706c62d5c0d0869f96c57fe417bf5a6b |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:f7af3bc23ddf65bc67caea1aa3c4678959ce081363a20a626404ce921bbf48c7 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:6942ba688a7db59172e7ab68ec03b18ec8ba549bb548f59fde2d76d4db84afc3 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:ba9039c9530f237372231dad4018178b7d0e4c3e8a2683b974d12ea80e1cd367 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:224bbd5cce0e5f2e434d1c5e4b24ed3c1cd73ce4d08b5118797f5341e76e3bd2 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:04c144b99e45594d976df23f7f5405adc64a48cacbb8ca6225dd0b2a4d89f352 |