dhi.io/gitlab-runner
GitLab Runner 19.x (fips)
19-debian-fips, 19-debian13-fips, 19-fips, 19.5-debian-fips, 19.5-debian13-fips, 19.5-fips, 19.5.2-debian-fips, 19.5.2-debian13-fips, 19.5.2-fips
sha256:cb7ae226ffc0e2341ec2d834b4cc645d1cb310a15429e429f79130fa0fad8795
Manifest digest:sha256:2ebd9a8eadb360b6d7ace71c7db8deb9286382ce006840a7174b802a6d3d6b32
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:d0e3caaa3f22979f199e7c57f344b65e51dabf1ec2d89709cfd3944783ae4665 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:6bd838614529df605c32e1ba7a9129487df759b14b5633a9c2e54699260f495e |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:449c5dfe374a15bb8e27f1a3a2bd962ec2e91d80d71ced5e52474fd1b14fc874 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:443a3794dfc6cc1de5e6a9ecaacd799a76ba54447e90e02879fec8b5ad75823a |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:c0907f03061ad448076eef76f3c5b705b7b009ed3d69f917c7e25118ad180ee9 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:e220f15ca780a7ed93c49524ae39d61ea6617d1b04dee77692d240101a846a15 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:6729e07dc5c17bd776a58af06ed87437c8033c3d4d1c7c5557c5b612e5dbabf8 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:fe3899b2d5725ab86e7e3b781db753b15199ed6f3ded402bd540d4dfe5c63b80 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:19b67a63b3bebe6887bc6c6df779e9650bc81e016e799ef9b9a439b09e2ddd56 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:9d1923ae1d7e4139c3d9183d67f4cb5e058b3b7c34b82267a76c55ac0274223e |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:521ae4f91e5b274d1ac8e68dc17410cf51de9834cee9f1b06b5fef35af4cbb3f |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:1d234d47368bb4546c04a5c74aa8ab599e4913f3bc4ba82891fe55fa426aeac0 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:a4a5de90ecc397ee946ab8defe45fe7197b777b454b869b13d7098347920b5b8 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:44d9c6d215533bb8fcaeab7896452200eb1c9eeeb3e26d5307649b485c96a091 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:8d538743aa8217004f0ac550cf60e1a6d75e5b3269a20c55e8f87e168461910d |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:2681d4f5d08ac304255b29dab923b9f28828f622fa010af583695718d7836cca |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:ead64c20b06f4c5745015a8e068c9751caa1537c76388b9af9ef8fa8db5f1bd0 |