dhi.io/gitlab-runner
GitLab Runner 19.x (fips, dev)
19-debian-fips-dev, 19-debian13-fips-dev, 19-fips-dev, 19.5-debian-fips-dev, 19.5-debian13-fips-dev, 19.5-fips-dev, 19.5.2-debian-fips-dev, 19.5.2-debian13-fips-dev, 19.5.2-fips-dev
sha256:913ae0f428222a1fef88749e73083f97cc6f849054a489cb8bac1ad01f61956f
Manifest digest:sha256:7f4ae8b272b134aeffc97cd409b52d71f7d3c08407bac808f0d973d33ea87f06
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:bf3cdd8d62e35f1615f352b2c093e036390db10b9c6c18d8d22310e89bf00a17 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:452f587d47c49497ce2b5e82fea8d6dd8da248d9d482fc4cdee4428209872776 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:9c12076736c23fb6d88485305322ee9779452200acad431af01c33de0e5a1836 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:ec4bafa7e81a2d09dab38f92e5bf398d33112693be60a46b400704b8e55bf634 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:fe3c8e80823e044b47230916ccea48525c3e5b7e38dda5417da74874687c85c6 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:c75c9aff60a4284b44a6b81e667035dbf5c9c197591abbf7d2af26c152fc9110 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:5d80ee49287866f959ff0e7908abb31df231157875d533e381abaa72287ec917 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:382283a1c3c63c539b7d0d60c6480ce5e1dc3d730c2b9f7b836bc21df0856952 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:25368ba584208eab1d211be6d0ae0cedf91a3fde48a70db99c899a115225f374 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:737185117587b7d9fd517a80cd9cf29a7b7404d122234c62ace9648ec650c6fe |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:fe8518758d1a4425496e4f17855080cb6869a3eda4d8d17967aafb39a6b92b13 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:c7831020f6f82d1d4dccd6f82a9b41f5fae974eb1cf8ea1f64b6c5858ee0d43b |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:3e01185e2f712a225a5fed97ffa2d07123b3accd6e820b1b36b51e71586ed3d5 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:c20e03648001a022b3f5bb7472b8bdf68e8b93573a396f03822884763ccb0b5d |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:53a02f2c433c05b21ee4b3266aca6f8ff7f86144725b90054c6d8b35ca9e270d |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:8b95923bddd6865f7318ca3a795589140925a1eb0c5ca122234696b01ffe7f90 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:5e4107ecf9d48287171b9dd66f8e659f03474a00883265d19f81f299f288a59f |