dhi.io/gitlab-runner
GitLab Runner 19.x
19, 19-debian, 19-debian13, 19.5, 19.5-debian, 19.5-debian13, 19.5.2, 19.5.2-debian, 19.5.2-debian13
sha256:05e7a2475d3359251b3eade56dce6e754c4ac805c42439f31156dd1bc71ec844
Manifest digest:sha256:43762bb8a05b5a8a704324280c2739f37899989a8a71efd622d6717ccd1e6f39
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:192. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:7f6b941ea9178e28b5ac520b9762eb45a6195fcc718fde8948de2f0030381491 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:a437f09ea27f4ed8f0277e6524f76f3934fb8e2b0adfa54af0e138777e4caa25 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:94d74f6cbba29804a5ac36d670fdefcb712b2f64ac2fb1641409cd64fa5044a4 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:88a92b4776eb756e047493ba7de0e3a9d866402c827fdd781197ec21c736cb49 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:2721183203f9580fcb60110bcf858fca4ea3c0d2d5ad80e591bf6a352f252879 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:00d9cc33f13e2a81bd97201ccc34658fa838fab8143ee862d1972a4a9b3680b5 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:57af309585aee499c6018ad65d3d120d75bf26eddfb591310cdf85558d7b964c |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:b7f75c957e30952a9504e7afeb230f91bbc1840d057d4eaa4fae29a47abe25b9 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:49fa13201525028fdf4dffe2cc2040bbf356f0b5c3b8fb213fbd7a3a01d71bef |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:b9aee879b08c4d48008736ca2684fc09c3472a9797bba63bd0b0ac0dd35584a7 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:01bf1c78777de655d30361c6cacedeb012e9bc036e90e12dab163ac45cbfb1df |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:50f095626f29a04a4a32445ff6c231906f2e666af30cb077cc551472f7cd6287 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:8158f7d7fc3cf3825125fb2b8206275c86ba73a3fc7d980065e5f45c44d7d2ee |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:fc17ae897b902402c615660cef23e0777a9221cfda1206d8f6df3ddb57432b74 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:c9a744f0f67ba8c76edbb1a8e78f33f2a4f60a3745e0be826e73cd71bd110bd9 |