dhi.io/gitlab-runner
GitLab Runner 19.x
19, 19-debian, 19-debian13, 19.5, 19.5-debian, 19.5-debian13, 19.5.0, 19.5.0-debian, 19.5.0-debian13
sha256:90777c6a265d8599e60b0b7f7f0a5f9fb8ad8570d23193396e4a3fd981b5017e
Manifest digest:sha256:5fb1be28979492051ff1614552604c88f6a638320e5b1a1245fc4b9815bdb9cd
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:192. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:66ad15350b472be4441836832174741aaa787737b2826a822d4104994b925ded |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:70483c01a445154d98597e87a74665d6dbbcf23798fb861798056bdbdc5681cf |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:616fcd04e678aedec8cd7555f1988d2e556b068e8847f156fdb658493fac029f |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:9f3926fee929e909d598c7d8119d34c890596190290409399d2643d667c1310d |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:726238205b0c463661ec8124bfea779e0cad44e48882875041107dc21ac4fad7 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:4968b1cbdd9b5d152dfad6d22e630a1c0fabe748a58d5d8e5f6b5aa4a42d02ec |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:8f570d48e68e27f59ea6fb810e8ec4b4847937f7a5f85957f4f91b58f4998d05 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:ab42a4198c7639330f56417c11054feddce914dbe10fa47018f05e6eca3e1de2 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:90cb18204a2168ea97c530c9df7a49ac63e5d86c1c8b82f87abcd2fd12ea3166 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:81c8fe09d928cede90aabdd24287caafdad6f55228dd4bb0c27b0efa7e1a98b0 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:165cb9a962c2847ede3383c6ad16d3e04eb8e664f27e3fb8693789e2b979cf56 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:7f1459e5bc625d4497000292d7151896f89a40771367d32f888124f19d212aef |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:9a9c16cb0fc3f77819ae38ff531c6bc8f0bcaa1c2ca37a148c9d3a0c57b67b20 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:fb3958cf00ae5e0d87b6fce5c3e004225d7760ac5d00235098958282a0b243d7 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:938032e203f158fe2fed75ffae52aa03e7429b135c84438f11de80711d6894f3 |