dhi.io/gitlab-runner
GitLab Runner 19.x (fips, dev)
19-debian-fips-dev, 19-debian13-fips-dev, 19-fips-dev, 19.5-debian-fips-dev, 19.5-debian13-fips-dev, 19.5-fips-dev, 19.5.2-debian-fips-dev, 19.5.2-debian13-fips-dev, 19.5.2-fips-dev
sha256:8516105bbbdfe75407a4bb94f1d031d0eb816e319507c00226d95339c66b628b
Manifest digest:sha256:1a48979ddd7d2ebe66549c4ad2f1ac43b63cd1042835f4cf39bd6035eb3bdc30
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:27369a45340f5722408a7674c98fe99fe56e5add789306402ae3a29f36f4a371 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:be4bdfb60f8c60d2deebecf2bbbdab08121e6240d2b6954aa7176bab384d9213 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:cc52bd25574227448adc7ef7b7225696ccf5bd741489b98807488f6c4c7bfdc0 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:f3f10bbddce64d22d550de5a62450ed5c080cd774d88efa3e7d35e90b2931d1c |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:9792e9ee675121187bfbbc6f2080d734a9ba39d1ba3a01ee437029d48adc6769 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:729f5a9e43a2928171827cd8f766e13c9df78236ce690e82ace68b90801fcaac |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:02b8ecf2e4c62efc85d6f751b5a7f01fef685a30149ab516a2350d74e16eab61 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:995f119eea8aa7064c3792c9a85319a9fa754de78b2701437d10a4c645bb8d25 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:9b04aa2c5ca6fe3c59c61359151f82cb6076401d2b3e42cb3f706f011d90f3a6 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:71d699a89222fe8b1aca688b414b88721a0df8e5f1f978a4471e7b8e140e3ae0 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:6f515fc92a5969b3ed73ea95618b11aeae26f9472aea2ba8aff8cb88b1e1fb7b |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:4cd2abefc8d8a086d837e2bd6aff2555714e4f34deb3baf751521a70979f445c |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:55e00c0ffd21bcff9f7f97362fa6d1b5a1d1f2976c199fcdfbf0bc7c7a859e6e |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:6417b11cc26d2c5af9105bb6d8a6850115f49dc8855ba04932ce379aca32c126 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:ded610d2967ffa35e345dccb61f487eddb73a0775e0c690ab2995d4ec18d88f4 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:04efc84d8d3125629aae579dcfaa68c3c7301c8199c1a32368ecc2c3fa713880 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:3cdef1f99034d497d762b67d7de874436d616327e851cca09c9e6c67206d874f |