dhi.io/gitlab-runner
GitLab Runner 18.x (fips, dev)
18-debian-fips-dev, 18-debian13-fips-dev, 18-fips-dev, 18.11-debian-fips-dev, 18.11-debian13-fips-dev, 18.11-fips-dev, 18.11.4-debian-fips-dev, 18.11.4-debian13-fips-dev, 18.11.4-fips-dev
sha256:9012d650c94a4e3799de6d460634616cc68c015c7b8d70bce5ed3273f9bbe797
Manifest digest:sha256:12514bf8ad2094fa1f96fd49c4c47c76ce9c15e6fe1aa7c5d190254a6ad1939f
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:18-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:834f319bd868c60b2b60a99acbe265e04a18358ef0d9adfe1ef71af0e6c87a80 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:a2addb0939b6b09393e893ec3da6442d0cf2c3164d17f3f452950a8f3a2b4c30 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:6f02997c6f66809aacce032237e08fdafc8b92b51349f84d57894d39278c4504 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:6d44d227b77876210fe433c98b35efd81d0454e5c9e48bc52db884c92cb0df69 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:4d0c04dab02505846c6b04c109b3c3ecc23dcd827810c3394431e924b512b9d9 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:6834b02977630058d2436b0dcfe1d94343575434ee19d34cf746a90ca4ba7327 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:2c9f6a747ed03ebb3e0dd16aa1549ef739ccc17a9b3a979c57cc7e0de1c1d540 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:dd2c50d7edb37420b75c85d677e7ec2347ca98865c2b982d196a9f2090fb0e87 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:6db21b187bf83d4dfd1cdc0f119b64f48731465c7548101cf25fd250124a4793 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:6bb7f00cc7fb7c68d96eb7b4f8c6dbce847ae3bb967265fa6b4f2b09b42dc975 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:3c4bff77eda13e3e09769831d41878cd426996f6e55e28f445ebdc8440d5f5f2 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:ba15c53d57c7f4ff9afe795f0605cb7b032823714bb40f3d90713d7bf81be479 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:fb07d0fdebab21e6d8aa0e26c438f5a9a151df8a0dd37e48075b8c3472278cda |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:2f675fd1c3ca6dd8a21337b102f4cbb5fc1736b97e96dd765dcf0a1a85878dab |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:d146f7423d8cd52b7950a329820e57d853ee570fc719d0ac33ee7e4e0d4e3ad4 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:e182a943030c85dd4f91d96b52ab2fae5b84cc2fc8252a9123c86c674d577723 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:1b1fe8b0ce7890019222ab27346f436ef7e3e7ee7090dcad131aff9e4c171f57 |