dhi.io/gitlab-runner
GitLab Runner 19.x (fips)
19-debian-fips, 19-debian13-fips, 19-fips, 19.4-debian-fips, 19.4-debian13-fips, 19.4-fips, 19.4.1-debian-fips, 19.4.1-debian13-fips, 19.4.1-fips
sha256:8725a1a36d2515747213b6a911f62d812c505490e72d033a6b96006ec9793990
Manifest digest:sha256:abf4252e094d81b4861258d02dabb289927212a4d3f80b74572c89c04c9c2cc0
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:0e29737bd90c401d4c1919f7ffc91c1af200b429e31151e73acb011448a9fa58 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:f2a366ffce7b2c22645cc12afc6cb542492e0e5c798b37430132b1f91d85fa7e |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:2423b03ecd476981ae4bc778b5adf3a48d5a36a5f9f4511a5815c2123a4ab2d7 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:b5892b689f078745382d23e43ddfe519d4aa95b8a8e59aa280a44cb100b0f5dd |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:dd8f44ab1b73a3f474188574a3d53531a0044c64d71d8762028fc4e46ba2c08c |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:ed2dcb1090dbaf8dc87e9ab54928cf7a31112f4e2cb8a6116fa59250006e9b7e |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:4cc725803817cfb1c99af4c3776d57c2230fa7e28f1ac8bc3d2d4ffd6aa4fd94 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:7152fe01116dd21e04a90ffe233b2dc3e07d749d877a77e1a56a29f78a19b43b |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:0fb433eac936bad34dade5f1eecd922530bd9b275d66de128b159632f1976db8 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:c97a5ccc35ec205424df7d8e2c259eb8519cf790d0ee9cd013e084926f227e4e |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:5692efe42de508f3087379a70cfe12c3a22ea9d1ff372dbe2b8087cec487bbb4 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:bdbfb961144a9872bd188e9154c430c80598ba5430df0e36fbc21b62c230601e |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:dfdd89c536b79da520cfc3249c49d0936dd37bc92483f145e4c75b0905b171e5 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:9fc1869e47911990d3554f4646cd5a608d225cd244bbac92ff2e7e6947a73536 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:b67b10b520c9f48c437d98d6bb803137bf8feff1b25ab9c258ee05d9359d4a89 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:bfe8acfaca9e8e1c8df2e5b5f4acdbe2bade5506ecb8d8f7cf2a46d2a4d5b997 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:50a42c15c2850ed8b8735cd06e97d559a34b1a319c95ce89cb88a5f17caf55e8 |