dhi.io/gitlab-runner
GitLab Runner 19.x (fips)
19-debian-fips, 19-debian13-fips, 19-fips, 19.5-debian-fips, 19.5-debian13-fips, 19.5-fips, 19.5.2-debian-fips, 19.5.2-debian13-fips, 19.5.2-fips
sha256:3b3437b6f31405dcf2b2d847ff7e329dbb8bd83dbd71c18ff354b6f7afc745b2
Manifest digest:sha256:1fc8a3f186b4166b5a1e44e7f5ceff1b04f2c0320af1a82ee0f9ef173c1de41f
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:58b682b58c75c3f1e285fe99b3c6fded6f65bea2b71c06966257465ea54c0b8a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:d70b4da64d59ed251663b3c50b65eaa9e78b446e52fb5561238ae1780990b7a4 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:ad941ec8b60ac30d2f6a80f8c8e16144d752b8d5ac7646e8aa6c600cc909cc50 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:b6bde4889497b89d3bc094ff4d614ee2a67aaeebff91c51f38bb81f8b6eb804d |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:f2bec8ae594613a1f667dfce78bda5c7d6c2466206f941481f5293e84660a57e |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:c651a1a9f2cbe4fb15ddd82d3eaf82acbdd78be8f7ccb4e1bde3e52010fc5804 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:555b941f93c119f29f098fa035818fa869215bb6602d4fcdb475ef2d72351345 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:7687d4b46868f2a66e992afab7659dfdbe5347536a30e6421cb44497e1726eb8 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:f197be486186c38224f344a1a0be0a598e803e381eb1a5caab06ea7feb522dcd |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:5e638a32a334deeab4f708e54f011f38b0dcf4761585b2571517b8afc540381e |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:fb27dffebdaa7957a7c74f075b5efc5e6b867a4eb91df068ed6f36591f265e7d |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:9ad1cc0c2f4b9029bd1e9dd17f91d470f8a0365bf654ab3ee442d069d19efb10 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:5d1278b00b8b6a7f400da8168cc8ecc6fc232de67c7b6e16dcedf647923787a6 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:158fcc53fd230a8fd0073c7c995476725110e051015bbaf1e5bbe16e03ec1bcb |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:05193f28875e6431f99b45dcb6f216230399e8f9f8970dfb43d6e5365350f48d |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:3250187260db55b08d9681d844e04e53c4cd6e71727e28c7e1e2d3e04b9bc9d3 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:cdcca7c5e289a739e619b353b10c5e8cccbfc5e8fb563ee523dc2d61240959ab |