dhi.io/gitlab-runner
GitLab Runner 19.x (fips, dev)
19-debian-fips-dev, 19-debian13-fips-dev, 19-fips-dev, 19.5-debian-fips-dev, 19.5-debian13-fips-dev, 19.5-fips-dev, 19.5.2-debian-fips-dev, 19.5.2-debian13-fips-dev, 19.5.2-fips-dev
sha256:fdfe6d6a2d7d7cda059163c7e1424369797d2adcf0ed5ce62302eeaeb8690f1e
Manifest digest:sha256:10ada21cb7b8ab0a20d263621342291c52ed954df48677e59690afbb18ddf5db
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:83effd0ca1b27ff9f66d8ea92ea2cb81162f25f863b07a7ab495c9ca2c809fc6 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:366c74ea9906c2635358a00d218ce80d2b51dfe3b356ff5e340e53c5a3bff145 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:129b85a3793aaae513814f448bf7d871b3573e49d874e8fb078893d5584081bf |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:bc34d09c0d31dbe4713e3a5b966b47d33974d527b6d2d951d3bcadee0e6e68da |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:d94bc4759c4521877ff54fe692f16164055dd3e304d596c776ac3e241f287618 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:5b788eda1e326fbf27241a58f1d73b9929112e865328bcf28bf4995f80d82e81 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:568ffc38148293a3026bf1bb1ce1326afe10e53cbfd9a3a3c20412eaef459d7f |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:a688a480fb6ef47e7845dd766bb2bf38e6347ac6d0831d6e489806e4dafb2a0f |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:3392b096653973db14e5359cec6fbf320a90bbcace5d197acbeafc8e5743c571 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:160a1afe9076984884e6213ffac8f41e4cefea1d079d010d37937615e4921ebb |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:232ce4c1a6132c3dbc5f7f132048e2f6514ef50b7e3830a816f0c2a31ea7afda |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:e2c2a257709dc44d15a057a1e3f1656032923c0f68581681f54c5b68480fd6c1 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:b0a4b099c22cdd9b7b783c4b721cef93e697164a0c90d213c5f390cc76c9e6cb |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:5498b1b48edd3cc1baf023341c007b3f4d4a7995ff67d821dab847265d8d784e |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:4eca38e7fa4e8c9176effb3cddcb303aa16954b5a42c970c0bc2054729c88e97 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:b3fe66f0cabe99b49e6d6242abe36aada962cbe03c1ced10314d52cfa0472166 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:ff933d888c3e4ec36114d437b0a76f145da8124338c02ba3c14729dc445962c9 |