dhi.io/gitlab-runner
GitLab Runner 19.x (fips, dev)
19-debian-fips-dev, 19-debian13-fips-dev, 19-fips-dev, 19.5-debian-fips-dev, 19.5-debian13-fips-dev, 19.5-fips-dev, 19.5.2-debian-fips-dev, 19.5.2-debian13-fips-dev, 19.5.2-fips-dev
sha256:3fee9eefc3997206ad9c2c8db9ce89f42cbe092aad95d00f8c88d547b2a62ca6
Manifest digest:sha256:0fc1dc4533593da890d6cfd95cf97e4800d402745544d706d97b112cd89bec82
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:0005b911d00fedd0be35ba0fbce3a50571bcd39fcc4759d7ac005a37c23a933b |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:1551a68e298c13ab927696557a56b178d9c8149631aec41d316a22eccb6136df |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:abe99d6d70f94d59caf6daff81be7668787ef169b31ae02023a23613deea2b28 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:2e040c1b53745013f76c15a92ab7046cd505882cf5e4bbba50f8d83895aee254 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:aa9d1fd2681d38eef621a84199523148eb4f607dc147eb64f78e5ff157f46735 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:e9a03b7a816235138f7dda8e4b50cd9b569ef9f98f8724e749c5fa63857aa5b9 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:d0c507393ffd6afb9c0fdf33538f5fc9a3c84f3a7055b75db29b656277a2ad47 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:4a23dddc70c729aaf42b215722a235156bb6636cc9f2223910a8665dec153788 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:6827ce963bbb21ba2e717a4f994bd07d78bab27b1782018b7a0a073d9ed725fb |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:e03290df29acff136f86b0920a5048269d01c4572761fc3f62b84295fef9a0f6 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:4e2ffceda85cce3fe35eeafd1da1ec90ab61fe5af3e3245aab9599cd5ad28e98 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:23c4756b0bae7b8943748a66620fa1fd69752b68e303d2a84c63439972e77f8c |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:0569564a534f14fbaf15c29c652c74287617fbd4e569df3aa03205dec4a7d8dd |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:fb4ccb36781c0410f65fd0de28a3ceccd7105bddfba00044d7465c04d74f6c98 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:aeb01c5c8977fd17f25ac224b7408552a4ac7f766c88275951bb267c12685773 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:b2dfddf2de040372cc246aa832e7adcf1ed18a6aad87be7b135b1ef5b4ee5be2 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:64b0377a7cfef3ec20a63ddb890b28a2bb321470dbd6f8fa4e01e28b49071e25 |