dhi.io/gitlab-runner
GitLab Runner 18.x (dev)
18-debian-dev, 18-debian13-dev, 18-dev, 18.11-debian-dev, 18.11-debian13-dev, 18.11-dev, 18.11.4-debian-dev, 18.11.4-debian13-dev, 18.11.4-dev
sha256:5492c725946ac666dc6c2634d86df23729911c65ef555ebf576f06035ff57ce9
Manifest digest:sha256:bdd1aa001c7dfc1921dec74958bf5e62e5778dc243b94c82cd1e4b93566c439b
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:18-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:51254beb41358904a41c8d0d809cd799d1096eda6c56083bc2d6209578ff1cae |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:a839c6b537e4e9d1022d83a1078b60732c0f80ae7b186aa73bde6bdca1ca8689 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:430a1e45f06c50fc3f70647c7e5a4db25cffe28041c50fe9d50579fb7814644d |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:8c929f9d8bb067121597218552454f900ca00508e08268a7ea77a9dcd02458d7 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:15cdfd25c2ee646e040c33e38284b9096408286ef5ecd80d201a7f51cd4fc235 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:d9aa7a837115e0675c65fee015a22462a342dd70d8c9e58db6116d245d0399e1 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:7f5ab234041f618d5177f05a27af598d96dee1d4e9f5aef54a92b9c90c872cfd |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:14860e78f94dd6ef41f256e9321d882154cb32b6a306093d7f9134ee159a968b |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:3471513aa9f1ad36e4d70c4744abc4e4e1f3aca9e6c9aa0c340c6e4d69dbfdc8 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:6d7519b1a4998a877683617a2f7a0a32d442a11993a34f02aad5d1318d035ee2 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:5d4f0e2405b6e122821034cba5c3ddc5ea337bd61f79072057c5c029dfc553fa |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:a5936c63fdbf196d85a18924c6758d10f57be2a0e04e499d26082391448f9e44 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:3d0c1a1c7d2ffaf7bfe09a1e3a2bc862046b7e9cebebb0d3ed066ee9c8462d73 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:6d46a549dc8632ffee944ef4639740e16f7983fc7897ed7fdb3fcc7a668a927f |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:d417dc35149dc832aec8e2e2691a93fe003d21adb76dee87205675f2d88522e7 |