dhi.io/gitlab-runner
GitLab Runner 19.x (dev)
19-debian-dev, 19-debian13-dev, 19-dev, 19.5-debian-dev, 19.5-debian13-dev, 19.5-dev, 19.5.0-debian-dev, 19.5.0-debian13-dev, 19.5.0-dev
sha256:d20c29c6e67dbec06586821285bb6648917eaa9de9994b881d6f8e00d1a29854
Manifest digest:sha256:2965ca76183d69a075d702f59107c92b3875beaa6fd3d46debdcdb4fd500d76d
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:f9729a1ee1ce6b38a7c2218c4e80be78862b78a46bddcd2dc2d66b4aa581d3a4 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:db3ce75bbba15b269e16323d9f88e83f3abce8641dc38745566ae0b548c3b134 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:eaed439486f6310ba431f5f0e2af261516baac12c83a46fbaa02f4463bcad9b6 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:1f30161882f7877d1c53345df22b1a05fa25f89d6a0ad9b2fbcdafb1cb0a2742 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:9e7926f4b550f27c34ba7b1e20550dcd4c6f8469157708e67b01cd60fb8c681c |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:201e8792104255a8d51a62297dce7b3863b6084877715e4226e8bbd5de543058 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:8264f9ead285923ac4e85593d54eec88811e074876d7c9029595a63b1c6d6c6e |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:dcd68957e9f3f1181d2d1bd44eefc75c7a2331d0a93273c2ea52eac27e8d1f06 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:ac24a6869f49c2db9839b7c3b0db79a44d5263523a940fdc9f5d0691e65c5ed4 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:84f68fcf7cfd4396620da57cd5c7586e8084b8254bf02988aa7b92260a5d495d |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:3e300f3800d3b0e9c8e84d2b4feaaa18c82bbc1d25557d930bd134f33c12df16 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:a3d2850adfed2a060c275c2683bf09c9c0b965af553c19a4530c3d2c323306c9 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:9b2bc5184310d210dcfb30b3fc7d3a131cc78d922197ea1bb4d778d8cda278f2 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:60148f95ed9b3e518b0cce196393581f0b2143bc5ce65d790058dab8f48772c0 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:640c80fa8bd7ed71e71fa4ba28bf8d9e1e864bd5daab1711c600cd65a8a42db0 |