dhi.io/gitlab-runner
GitLab Runner 18.x (dev)
18-debian-dev, 18-debian13-dev, 18-dev, 18.11-debian-dev, 18.11-debian13-dev, 18.11-dev, 18.11.4-debian-dev, 18.11.4-debian13-dev, 18.11.4-dev
sha256:6d3e5625c54fcfd33d13ba5115eb2fc06914e1d7226fefa8a98923d79a5fce46
Manifest digest:sha256:b605ef51d94394d07dbb899ca39a4e9119c63630ff0d9644c4d66550f5b616f4
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:18-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:1365f3eb8fa189d5bc2ad1e6d369446512937991209d71bb56515253320197b6 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:004bc838e617e81fb2861fd86fb7e81a7b77e81b065dc9b2c0993e5d1207a8c7 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:461aa1b89b9795b58ccd921c0cc20bb16da90854cffc27a9a8b0cdd9568143e0 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:2769a7472cc83e5eee0201cc73c25beaea5c9378b98cf89902d4992da751a179 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:48f8eea4eed6d547db35e71eb3534829b4d1bc7b27db7458a4f520ce342273e1 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:cf9fb5de29b813848f2e3236ba4e9620b1f0b38d47fd5b6358b2c4a65af65866 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:b40779c1519b3057799c1895ed4635f7bad9a204d1bcd6e21d2b14859a4013d3 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:8685a39aace4a38c8e27c23b9d8ba51ba4894c341f9d3ef2d0cbfdfe226ceb7f |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:b6ccce214b6d42f18ad97b360796bcd15db193055000b3a64d3462071c3561c4 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:5070afce72fda27792d6eec392a16047f6b987d5fe7adead8a3239d749ad4eff |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:6202392576513f49145cbc84fac3bef1704c6e58f24958a26d5e9be22e42fd59 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:0f5b4b18605797abf7540dea0b39f3c64c3e8bea588fad64284a897f5fcc1cab |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:d1b8f1bf5eafb4637b0b903e23436af7033ded21ab0e6174706945d1ef079c56 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:ee141e163a93a602cbd900c140c708a414ef9276c6c69dbdca2da02fafc5d2c4 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:98c1869186701c1f918d24a3b3db63819073b7683726aa5ef37d0f17e40cd294 |