dhi.io/gitlab-runner
GitLab Runner 19.x (dev)
19-debian-dev, 19-debian13-dev, 19-dev, 19.5-debian-dev, 19.5-debian13-dev, 19.5-dev, 19.5.2-debian-dev, 19.5.2-debian13-dev, 19.5.2-dev
sha256:477ae205545109a0e7759af040d2126aa89dac0549e11e4e46d6484835dc5731
Manifest digest:sha256:477b7e0a983b56901e508ac1ad1dc009c2aa99fb0c5504261c2dbbc3560da721
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:b7c0ae0109e6b01212d1b66ac5ba40012633b7baa5fd9c706fa4a003a8b99fe7 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:db6d4220c9f7c062b81a59bd02219c2eff0d628d0802f8b2d029202d4039b33c |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:5883107ff4ecaa44be86ed3471809632289acd7df2c12820b66389290cdac2f3 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:3dc19dd32714d77ca3cdcefd1b22ca23e06a7d3a5bf197ac3446bfcfc9e3f376 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:abb555f1da0c28238d8ebdb571df91c757c4178771b704d7be16847f9683bd6a |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:23b0f108a23b43fd2cab39c63ce3ea68cc9358d3d488e73a0f54522a128404e3 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:3d796bf1be37e203fbb5c7f46999b360e53cf57db4869c5fcacf6b40709e2c0f |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:820d5417c7ce8d590daff64419d22f5fba4c7144d71e771b7aff4278164b73d3 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:30d89360300ad1f8f1325f03564a9ccd7f7fdb45492fbcf3eb1777b194eb988d |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:5319d898c9c912d454f6440bf05f18e96897f72400ad3cd93a2716c10e157acc |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:c0b6c7d365218f83459b3a79926f59574163952114dad68254075cd45b717076 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:7de4c54f12c35350c0949783eb7dd3ed60232b490980e8d137b244f5978d9e15 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:21abdf9633271605eea4077cedce588cca18c7466f4b8fb6c5e3069cd16276f0 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:62881fd5abc81ac1282296da8158e5e938aeac85b9bd45e749111464cecedbda |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:2ef3bc29674094585ad2779946e91c4e090cce82593f2bc8dcf1520082e9db34 |