dhi.io/gitlab-runner
GitLab Runner 18.x
18, 18-debian, 18-debian13, 18.11, 18.11-debian, 18.11-debian13, 18.11.4, 18.11.4-debian, 18.11.4-debian13
sha256:d87a86cec14e0cc799815e4e0737f08d9a48c29e369c330edfae7e667f15c8a5
Manifest digest:sha256:88c8b8ccd4fca32d325cb9d62541405c38140bb59d50d7ea16ff5635243304e0
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:182. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:fc470c45cf7483724dc6b86c2a8c645862cef06aa1b3785fa9ff0af8dd2bc4ba |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:6d9bbc4f26394dfb306e50d60e63ab720da3967b5bc378c740f2cb8d54ec46f4 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:dbc1cc7a328aa4d855b3cffce1eda55ecfc277fefcf09324e6dbe8e138f625b2 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:012ccb327e77983b8829d5eaa07298719f363b3e1223b72194218d9353a52947 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:3e9c90f4755cd04ae51436d164d8804e2bdae6a61293f362a27a9efa99369210 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:3f342e4d4c32e9c19318349152b6ccb644c4127724e8fdf4cf850bff47cbde56 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:c9c3a430656e52db87424e26b12e8f7b99d8b4639569880345c295d5f1a3b932 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:856a4807ddb377b9b8006b317638cd03a883d678a5212e4f9a3a6be5901a43c2 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:b37b340cb565bc5ad919ee5c689641e230cce8ded53b8ec0cdc49388768bd55c |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:37cb3f274640ef9ba7571f2539721c2b41382a41d562547e3ec4846e04c9fe1a |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:65d2171b8ce5b14e24bf778fdd5eb61a620651c3ff61cd49427f55d5dab8c86b |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:b2df8b1c2ef35effcfc267b8c469d593bd2fd237ea436d96d3e9a1647849a73c |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:a4c7a248777c2b8ebe3e0c768f18377a7c6626629a8f466d3cb9cbd154a24205 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:457758cf4d2b327173e56b0298c379d19a158bee465b69dc7c4ae590fe45eb17 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:bc45c5b8dd4f280f095835176feb1f23bc559636da9d142b46b2269bce6f18b1 |