dhi.io/gitlab-runner
GitLab Runner 19.x (fips)
19-debian-fips, 19-debian13-fips, 19-fips, 19.5-debian-fips, 19.5-debian13-fips, 19.5-fips, 19.5.0-debian-fips, 19.5.0-debian13-fips, 19.5.0-fips
sha256:bf3b871859334abdb2ab87dcad5ba7087cfce95e4ccf341eccdcf684210be633
Manifest digest:sha256:0669ab19e5bac6a6a90d2d8f463e20074acb09c4c6e1332f225bc8ad7feba585
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:766c1886b3587ce3325c330340d4318e84e24a8b60dab9f818fbfcd8cf79645a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:8ba6bee5460054dfb153cd4d9f66c669ce6a84702dd0ae2d9bea27f48c4beb49 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:a969428273f647206eebfcbb178f08cbc292bd2bdb533699c5b2cbd668c98c0e |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:4edc8c32f2b616db5b753f88dcad80ee42971ecade07420981fcfef12ea64fe9 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:fd5945cf873c375d7cee4bd9469fb421b2b981cb2628de7ff1bef7df754909cf |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:26f1f89d1f5e52d56b71aa170314b452c2b460005e037fff6ba40a83d54d6334 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:a1685e2bb6fb201dd6cfd95988a717126d83f6dad8e071dff2401214868220c6 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:90e986750bad176f5f606731488fc19aa22dc080bde41ba40382b9d1f05cb68e |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:9f4975f9a287bc219e59721d4953ea157f1cffa7c035a5b48ca01a7ffe552ba1 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:5258ee40cb414bafcb48df2ac2cc6f75d9bfff6162154a6610b432a5f3c2f8a1 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:f3f1a9ca3d4ce590777de8b320149df6e28c2f526bb7302c0446a097fb5672c5 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:6cf935a828a97b88f13ac72588b5fe766559ffcaf471b80c31a61a2737e3b2f3 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:9d85938c4bf43b4e1f70ebb6710cf3ea18ee0853e3c206cc2f6b5f543c264f8a |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:9a569221b169a76cbf90cea62dfbb4384758253aef127836ebf8657b4d322f11 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:2e701a3e87c7ff1b442478bd46ca0aa481cb24cdb754a66e2e6615fdfe449bbc |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:eae2cc1fbf0b99d42e056942d5ba0aece4cc56a0b3236e1fc188faf14409f9c8 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:44a8921558e67d11473221215dbf20154eddbbdad19a3550e47f1bf0e4ed1302 |