dhi.io/gitlab-runner
GitLab Runner 19.x (dev)
19-debian-dev, 19-debian13-dev, 19-dev, 19.5-debian-dev, 19.5-debian13-dev, 19.5-dev, 19.5.2-debian-dev, 19.5.2-debian13-dev, 19.5.2-dev
sha256:c90f81a9cd3d3969700fafb17e3a3009eb8c84ba9a881e85592521b27a6d9553
Manifest digest:sha256:83b71f92f74e84cbc4057a12c3a96d7c7ba240f9d6dbe5ad5326568322a051ba
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:2366991e9d95f84e996a22d1d58b559a7a08ff02d2b281235d7fd7010f2421e6 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:68acbe6a7d578a31aa9b01c0f21935ec9f76ed7a82207f8e6eec323cf34a23a6 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:3832e4e0fe56ad97f66cb931c12a07e756c95825c676a02885eb681014ddbde1 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:a9d30cb3d3f5a7992997fa41c48d3d0b33089525a21c61341a0bf2d9441aa97a |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:7658f1006e695052beaa6d83fe42431962c112639119d7b8db780deb6c3225ba |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:d217e6d5cd051f887f0f3b960b2402449ed47c86f770d3b63c6f15dfd54ea3b8 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:80fa6c339e2511f86ba353a5aa6d2204be7471a91b0e826b9f580489b3e68e89 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:ce3ec633610ed64d1946e6466350778ea9e063ab298f56a22f597121f5c07d70 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:ab031030a9269017d90b903f01ce080d71c2287102ad68de42efac7256482333 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:de19d3acc0955cf6d4615bc665c6bdc7c66f6c4a9f316bcdead699a5951c38ec |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:e1a2296fc6fae6f620a8c43ba37f1d3b0878cd348c49c2a37fe5b09fabe02ba1 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:b82ae20f1a7de5d764b59b04dc6880ce724e14ac7286b2e34afa307b66537b76 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:9550a1660a0bbb1437edd70fb394f7d25a934c2be1b16a4471bfd6a8723294fc |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:81cf4562e9f297c7a514513b8a693b2d2310f7caa7025ccf0caa5162ea7d4128 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:084ae9c4f3734282475b9eaee8111be044008ddbb4ba026393a826756de8b793 |