dhi.io/gitlab-runner
GitLab Runner 19.x (fips, dev)
19-debian-fips-dev, 19-debian13-fips-dev, 19-fips-dev, 19.5-debian-fips-dev, 19.5-debian13-fips-dev, 19.5-fips-dev, 19.5.2-debian-fips-dev, 19.5.2-debian13-fips-dev, 19.5.2-fips-dev
sha256:a55341d007c13e3ee5a8fd0f929ee1bfd12f90a37d606b79c2c5253ff6a8a04e
Manifest digest:sha256:0aa86acdd2d0d396a1adfa12be6bdd215d21e026f5ad3d64ff646f5bcc5a734d
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:cbda59fb2b78c5f00e9dfa63ab45b6f85043d6fd8f8fdde9ae76be4a8f4847a9 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:2642195f6db1ef57f856ea8fc8c95bbd0073aca216c44fd1c2471b50898f9e27 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:048bf61bc75d78574f5358aae31c1a6deb7741cd258b716586692f0cc67b45d6 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:f7b07ffc0889ee66bff4b7db829743646fcb838951fb681d0132f2228d34947b |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:df14748edc00dda91042e7802bfab8f329589cc23e902da84a0aaaa3e05ce774 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:a392020f19da74d706c2a74b64b765a360e30dd560b63c450731a7b0ca8c4978 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:d2cc34fe6748021b4ec03d59420dee192129b0d6349f7a9b3d843bb7c9d0dc6a |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:82b2d8eecd5776e39f7a7afa54e48c92bd3a307ea7d2f0c38781472477da3c35 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:17a7ffaf2b295e4b90c71c1562ffe6554767b5d16f02f62597c55d5f89b6a2bc |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:13c2042c029fb4d96e9cc2186c857b089206788f9ad98c73083735db8172ac8c |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:f02254031a903d92b7a4cb11e826fa155cd704a6a2d9d4bf8b14c6032c22b587 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:6cb96ad026193da525d0bcee2b8ad67050b707a92c0e279aef07156eefb1c3b4 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:406ebaa1a1ef2b640eee4f010f14489a3749016381ae0e1c4b1c99d8584145a2 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:f650cd8f8bba887c6016463f5cc12668c791fa31c0d4dbb93c28e900017279ca |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:5a06bdf30c1b37afe9f851fddc559445546dff193b5e844f42ff15646360963a |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:75b66d379141964a45ce8b49d1673e94275bca741a0876af3cc95cdaa37349b9 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:a08839e72059a0f3294e9cb7e0783edda129a7e02b054bfb2a9f6b6820e616f5 |