dhi.io/gitlab-runner
GitLab Runner 18.x (fips)
18-debian-fips, 18-debian13-fips, 18-fips, 18.11-debian-fips, 18.11-debian13-fips, 18.11-fips, 18.11.4-debian-fips, 18.11.4-debian13-fips, 18.11.4-fips
sha256:8bcbc8282bf5d4ddf4c58d3ab38258d2ef302c5446c59e54c89d9f6dcce3838a
Manifest digest:sha256:b54c411c6f316e749ef755c0d919ba06abda96938fcc8e9689e097ceb1893324
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:18-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:ef96d758f242b132df74da19e93fe1d648ca212dc88bd8d1ae8961527ccbc638 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:ca03b73723418827e507d4d27f23f81d78981eafa8bda4997b44a4165e444730 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:99346455793a40d37aa4a21c579dbd49ceb42d248c0c4d3a891bcf4897ee4127 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:ad0a93af4b64e01b574a81e205ef0893d23d00137809671c215c2928b0cf6b2b |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:d37300e97b251fa0f36fff6c77f7c881ec003d4d78890660a9a4b3cdff44f54b |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:8959bf9b69e49ff2a3799656ebc9459c1fb9116fc6131a0ea17924995979472d |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:49a58ed0d731d9a366ed6e1844ab5b8107c8a3ea7eeb93da1be78c40925025b3 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:4777922354da003b9f53cc35e61114004dc097fcdcff7d191d294c5e9dd5bb19 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:a5665910647c7fe4bf08abba7bd09058255249f53e1947c6e6e1d0e779a07d05 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:8cd5f2947d4d6d4dfcb128540bd3c97d2074f3cd76f7c45a7c3f1f501a774b04 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:ad2ccf63b2c29b5834b9acd0eb5b34484d614bc0dca0b8455f8c8af89d9c691a |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:fafda3be7193e72d3a23e41219f2d2badd168116c016890df821dfa7a577489f |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:43bb7b3a17c097235887f6b625c5e7d6ffe3f938614890e55801192f94111131 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:476566e7db3c197d180f7660397c4ea1007e49949ceddc7e013565bcc2ac9d5a |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:3610dfee64137da4b4951be55b758462d00e36e263c0db77738856fee4b91ccd |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:264f8a534575b28fa63032f1c6658cc54a38f9bc717d7a82adb60e763943ccbe |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:d696798b582d992d997327e6099b3fba0b1987dbf56f29f83a132d87e3d6d4ef |