dhi.io/gitlab-runner
GitLab Runner 19.x (fips, dev)
19-debian-fips-dev, 19-debian13-fips-dev, 19-fips-dev, 19.5-debian-fips-dev, 19.5-debian13-fips-dev, 19.5-fips-dev, 19.5.0-debian-fips-dev, 19.5.0-debian13-fips-dev, 19.5.0-fips-dev
sha256:13cbb7723b4246b9aff158fe5487ab2dcbcbb029d581eda6500c6d3494dc3bb9
Manifest digest:sha256:d1c48f2182fa7b2933c35e5d8569ff03be9f366b68f3b82a3b20e6da5899c209
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:913579bf595275a9bffa688c42ec0a401d4da0b7019fcc2fabd32e8858ef085e |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:2e716099cc1d1677ea91ea9ed7e9b98f98ca757ad491ee2104dd0b5235c4707d |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:f59d4c5d8ecd1c86b23188542289ccb04fb95c0de9c2145ebdb8603706f84106 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:54466d355e340117817340285ae179f386a7f9faa6100c09e493fbee497ce9f5 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:825111e3514f05d2be40f3dc8dfbbc2c58ff2eae7aa4ba1a7bebb8ad0e3e05d6 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:f0f26d70d3796bce533ed38f1e27d32c0e7373a87a2d9458220dea8d91ac5f90 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:02455709896f06651a5fc445176708941e830765e6197f9b72d5ec784387bd5a |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:079b7beb3824854a5dae4a6e7c55a8a1c90d4ea208d6e6874f44afe8f8b8768d |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:4e6205b86487de0f67444150bdcfb36fb5b8dfb4b50b6bb38ce5d096e0167302 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:4dd5b5aa4302297e077e062c3041cc1f020b9cdc3d8a655e7e2fd3bbecb4b02b |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:a4d05d64508e716b3661491e764bcbc4ede4d5510f54a55b86f325d4ddac486c |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:28b0971dfed0e29605dbaec475a66b26030af660cc899b14562cecf0735fef63 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:a98e0cce50d0809aef07e4c0f7737614ef4e30247211c636b8b11e4a092205be |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:cc3d838ee8595e4c4decb6feed7e120cc623fd8d38529e87c9016b2255267848 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:671ca94d27463ebe012f4e10422761918e655af29e52f66ebc6476f2ac449e43 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:ccd7e442aa7d6478c7e148eafa68ad9dde39ec6eddda19f9209bb1aa0db56618 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:beb2c14c9c5736827da12027937d65ef80846444a214a743b71cec9a7365251d |