dhi.io/gitlab-runner
GitLab Runner 18.x
18, 18-debian, 18-debian13, 18.11, 18.11-debian, 18.11-debian13, 18.11.4, 18.11.4-debian, 18.11.4-debian13
sha256:704f175cb8407339817a2256eab049e18d47e3658c0614651776d06455e612ef
Manifest digest:sha256:3f6c40c872b74e0f2a99d8ee1f6fec97dc96054ff75362f9940110b8e5f8c432
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:182. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:aed5042f371bc28753d20413a5c30fed7fbc41dada10b819358dd7d44b3433db |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:60a9437802b38527f35e35a296c59294b25648e714b76e2e13d2f34a5a6758dd |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:8848a73f76a2f69f5b8166250ebfb5790a7dde8390b29e1e1cde852b0cefc4ca |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:545ab46b97a026d573b29b51befbd750ac41ab63c6bf9ab322695cc3613ccf43 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:3b4857e85d540123b6ab9e3bd17adfbd78fd97b64ca7424f68eb9c0b2547ff8c |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:462e894822eba80f2fd55b2f68e2ae7ff408fe6d7e1fe106ad3661cba35c628b |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:81352bff94718f86f05a344f5cfb97a1e51b6082d85cecfa44ee01e418c9fd74 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:15b3c423c503e67e194ed2839cb5b745850c3f6246db5c50700e580ce47535af |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:c8f003311eeab1081db171cfe3c1af685caae37f34cc446198a7c7e5e57de986 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:5bcfffa1a1c4eed3f0da1017ec8642fa694c51920b0618c5d95c8e0490742c5b |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:49a460e58dd38156a8ddcb94247191db691d54d55e65b9de6d7bc141ae677fc6 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:4520bff049a535282698b1c81cfeb73d594666286703570772e7d1863e698bd1 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:0139a9c2444811c0a8801bd242530f8caf1934369baaccbead5130067913c05a |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:b464d5b55d101afaafd14d0c049c80de8e39d1f2320d27022e1555beb598ecb5 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:adb1cab637d9b4f0c648c1b1d018c78a53fa94e1582d5b75747551a32e618fa1 |