dhi.io/gitlab-runner
GitLab Runner 19.x (dev)
19-debian-dev, 19-debian13-dev, 19-dev, 19.5-debian-dev, 19.5-debian13-dev, 19.5-dev, 19.5.2-debian-dev, 19.5.2-debian13-dev, 19.5.2-dev
sha256:fa431f07e083caca72426f961dcf910e352eb71afe75501f72a54bc57feb79ac
Manifest digest:sha256:642f4ade9b5e017ffce5e7ed390d097b24f75d4dfbcc5b1860326c5aee0579ed
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:1d85c6d7310436ad62c17a782e46f093b9300a9aee6dc4d8b3fe28f03a76fa7e |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:e6b67090357677f10db6a3ed93dddcdb72fc840b754653e1e896a8ab20819a06 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:19e82efcf72c01c1d0969bd7967d88693a1039e666fed29a9e7a50d16a9240f4 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:d65891730984f7dd3aed531ca23fbcd9cbae2509d59cbfcdb79c3b6ee1d3e024 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:569d1b601c3d52723b62cd225c851fc78d52b9ccd976f5da000956bd2f84d8fc |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:635384f7e2e5eb36ce6ee404e37415ab0beb608668b00168de5bbb651b6cc04c |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:af78f2364ebf50d857a091a6f21a8a7183c68555cc2da7549ebe7422f22eccda |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:81d70d5080c1205e039b8045fa1ff05fd82088586fe2a42d9cac8cda3aa36679 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:6adc58486ebf825f8a2f48925affc8b0aa73d22bee5d33b0d78110cb56907cb6 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:673b1a8550421ea61ef501059d11a7509471497f293a1a91084ef21921c0e56a |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:48b021f601a7ed81f8784edf0d694e07c84988e8c6b6c9dc36aaabcfc6307efb |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:1185c6d484149c44aafce601e075f4a083a63c8bf40f01f34a62b31d137e9153 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:5caa63e1c4af7adbca4ecc3dbeec85cd711e23e7a452a7e8abb2b21135ee0595 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:95f13e7f450917869a00459c17fb266688e394e067b649b6c5b9b2f6ce9d95ea |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:d4ca2efaf3cfbb28293484cfc6e48431a5d21772ee959e0d9527d0f7d811690f |