dhi.io/gitlab-runner
GitLab Runner 18.x (fips, dev)
18-debian-fips-dev, 18-debian13-fips-dev, 18-fips-dev, 18.11-debian-fips-dev, 18.11-debian13-fips-dev, 18.11-fips-dev, 18.11.4-debian-fips-dev, 18.11.4-debian13-fips-dev, 18.11.4-fips-dev
sha256:d2c6e9fe8cb332cec34f6d16afcac1b2f9312ba5dd8229dd4c73f228c5362612
Manifest digest:sha256:473409f4449bf73af66ab60367eec59f779bbdfbad6ce6bcd7d650bebd130175
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:18-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:dd13e220f3dcd2734df41f26c7d3ef83d1b126c3446a608a74f07c512387e0d8 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:aec7e977f67789289404acfb519cd30b7bf27e6c2cb47d7fe17209d9c09c680a |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:2c8f3c2f5f49f40a53afad7b88c0e35515430c90907e8a02e530210928bb7013 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:ac54c91bed9ab0cbd82fd39e099937496720d3886e820245d896550e7ac5336e |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:98cbba693f119982bd5784ce1fab9228bf8ae59a57b8d27761d6622125285451 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:98c9ec07d55e00ab17ee79b5f3ce908669b6541f5a2e8f260510cdc612330350 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:3c33cdcf3d4d709c64949aabac6a10c5bbc8ca57ba94a9be1741e6836f719807 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:3ce694bc4dd4d90e176b6f0934e883747b3986a7e996bab45d5d9d86d836260c |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:4a25525d287d68a104d32aacff9c7a732e38ec1ae0b72d153d948d9d5acc34d1 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:49707e30c6843fd84f2b5e00028254d112e8cee6aecf5ce96b591304fdf3fbac |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:199c02df5119e2e6df897991a96fa14a693007398d7bb48554676fc0bbe4c41a |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:ecf178c452e11099c5bbd27043119ae42b7966846398708618ad09f2bae2b055 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:1735b5493aac38c467cab93604825ee8ae410cdfca6c556beb383743b3644444 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:465f45e492b02d535ac15df89ac3bae97ccc575515c68493c56a04ab79a40cfd |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:9368f8494e9f7d58b30110dc804c93d5b98c636bfd9bb775712fb087ef8b528a |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:15918c5c2114b594ba1389ca558737a9a3726d1390106e4354ef678c3647a647 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:25a9e2eddef3b13a06827cf76d896859fd97e35733d68711c6e5a6fcccaa72fc |