dhi.io/gitlab-runner
GitLab Runner 19.x (dev)
19-debian-dev, 19-debian13-dev, 19-dev, 19.5-debian-dev, 19.5-debian13-dev, 19.5-dev, 19.5.2-debian-dev, 19.5.2-debian13-dev, 19.5.2-dev
sha256:daae68728953d3ccab076b4013922eb9937add7b9f7cba477022867c9b63b96c
Manifest digest:sha256:08dc738c60d6a4494fce26790e0da2ffdce613255b9906526c44f9286beb6723
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:c345b58ac9b2adfcb10d43254c279e47a241496aa448e935fd64825807e9a4ec |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:2bd7487fdbc4cce342b993897ae7e09d32fa2bf558a5b8b8d80b685a9eb4df34 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:f3c462cb9aebdeaf7a65ef5b996aef3bd9b7136746e473749de74d8ce2369d11 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:a39ee68a432044d6a3abdae2f74e20db5388e3041292f547b7e10a5e4fd31b9e |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:a54ba08c39e18dd86211ac626894105c20605c088ab22e39563844219a5bc897 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:be0656b852d28ded2a56d6b09637048005000a9bb9abbf95d2a9613b15ec44a2 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:90b1f964f0c4e3b9444a64b6afb797ea4cbd1036f1b6fdf25c6bf8f567eeeb6c |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:dde4fd8c98d7f09ebdd377f3c4653dd9d41267c9f5122dfb192a68958969e873 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:24db53118ada9b29ba58909af32d27ca03ef0d393c49086ac51b55b17f1a2b9f |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:925a80778d8990c240402bcce02453a294a96d0b768cd89349dc06b5da50a144 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:367b7e460e27afd6400f541df865991bac62a0f7112f22e386f1ce7a2ced349d |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:220624971cd36cd2c828dd02cef9b61d8f5ef1ad3520c045b8d4e24db467f538 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:df6eadbbef4db70cbd67fe77d77f853336108e3d71156ebbdc5915b7187a4ba1 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:a6685ebdd3bd2ffd966ac41cde43af7789ac0ae4ef8898746a9be3fe385e8a1a |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:234c6b7603c8933fee155abc02c271bf1594029335f5d0542a1bf0377f30cac1 |