dhi.io/gitlab-runner
GitLab Runner 19.x (fips)
19-debian-fips, 19-debian13-fips, 19-fips, 19.4-debian-fips, 19.4-debian13-fips, 19.4-fips, 19.4.1-debian-fips, 19.4.1-debian13-fips, 19.4.1-fips
sha256:d6213d263ec869413011c41e7ff6673c7ed792ccfffdd32dc2ae298b8774d4dc
Manifest digest:sha256:d5fca904d69c01bd89b133f63216a2dc343a0163d4b03cacf5095af7682a7ca0
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:e817ae0ae99ad673f73c3ca7728ad8a9c7e41fbbc4e5918a2cb520b79ddbbcb9 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:52343eae88312fc4c4abfd9d7392b06cee70267b4594fbad78d212de122ad312 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:04322544d0316a56a60aeb232d4e186cea4de5557c6319689e1e86780d15f676 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:0ae4b28ed3fda1de0e2a316a978e51604a73a4bdc015ebd6b2252d5592d53356 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:a87fa4684d2fe6ce2b79b1272d617cbe010ee2a3c01265e65e06ab28efca1a53 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:cc41c99a885494c04a77e161edcc641fdab3957b315060bffca44a663dc8b8cb |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:04c05e12e9ce3f8a5661f76d40a2b74fd0e766bb3da5def3467d630fec2c3bb1 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:d9b6504bfe27d9c475b432d6ea6cda1b43cb88f4f63bfc19b1313ffc3d01737c |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:603729c6f4ba6dbe8f350e01ff0165747fd67ee01e2afd4793c55b047f61a2a9 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:cb852e4c0a4add1f7dff357bfe131d5b692daedafe08180d5e1c9cf10bf3d9ac |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:21d21acfb9e420cef79050038620f1181335efde29d9e417d0b3c5d17cc59652 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:c26df54c44f5231e2a45f80db053fbbb2bf8c5b4d9478d7c53bc398eab79325a |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:23e2ff68c0b6d575e5460b8198b29498f975e72cfc1c5e37b7b091a130fd1fe8 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:b4128fc2054b81960ad8eb031e15391aad0697ec3bc87786fbc8d843fe8d08ad |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:436aacc8f749c50a1b7e4d7c6af5f8fad99b93d4e07167718e2d9796f6726c40 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:95ce13397bd49156950f05ae58aeff710d00d36ddde0c34246313f542fa177de |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:2aee9ec135e7507d2c3637ab2d150a146bc321c1789076135dad3dd960619f7e |