dhi.io/gitlab-runner
GitLab Runner 19.x (fips)
19-debian-fips, 19-debian13-fips, 19-fips, 19.5-debian-fips, 19.5-debian13-fips, 19.5-fips, 19.5.2-debian-fips, 19.5.2-debian13-fips, 19.5.2-fips
sha256:411e32316413589f04db039b4b183aa3115e05c1b427bc76dd01c8a13e8c4286
Manifest digest:sha256:15ce0e2f4d9e4d0517d45df4a3d08f21c7456cc2b195ab50d3c39c0062cdbf3f
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:b40a9f9b8c5f5ade06899c31f6ccaaef1137aa58159a50e81f11550af666b9eb |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:41810dfdbaf6ba1096edf3f47ee8282080029aee764ddaa8a6dcbf1e1c79a284 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:088288b06ffb604d830c9ed382d20ccb2af433cfa0e74e2db59cc0ed91c30991 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:e91302a8372eb25045054db184bb82ffca4ca33545e37d0284f0c026b2ef0e11 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:b306c37bd446b2af3bc3aa6ecb51256d99d3fcd225f06e32fc120de92d0f02ac |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:d20740e15e3f44543523db3c8500cbb9d3d1414fb76244a60fbd0af59f12dd24 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:21cc79a13050e32fc9bfb1e86739fbad6c40ecc234808346ddbd6ee8f6c017c9 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:2554cbb71295da0cfd0ed052dbbd5c7a099c802ecd0b0a4c21714bd9869c6f14 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:c4498056b296738457cd15fd5e49311b81bf251fe0f43edffbfe69efb5e4b57e |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:de87616fea9a60c5f024df60730f5027aed4f96a1e02ff6159bea5b2593e72cd |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:9a5ee0c786f68565db4626724fedf589314c51ffdcbd21bdcebf0b0b97730c31 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:3780d85f440b2ddde84f51904530aa4f9064b9cf35275a76ba89f40a91c5afb1 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:ae5226ef8c2eecd035e8e2d361e41d5d50ca99eb433ed8213aa871c15736defb |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:18ef38d6e7bd874a3fdcc241afd85a4e4bc3bf5ed198d71ea0a49f6af17839e1 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:607d053bf2789bfed058e30721ec84236f449d5eabe6d6bbda4357aa307ffabf |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:6eb95c93beeebcdad428fcaca4f7683cad5f0db9d8f4ea3b72e63f71676edd59 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:9e3103341bc5fa7dd08978b6e50259d314dc9176ad15d15c25e01a75b32d1575 |