dhi.io/gitlab-runner
GitLab Runner 19.x (fips)
19-debian-fips, 19-debian13-fips, 19-fips, 19.5-debian-fips, 19.5-debian13-fips, 19.5-fips, 19.5.2-debian-fips, 19.5.2-debian13-fips, 19.5.2-fips
sha256:d2b514c28ea034935d9c9fd4e8bf4ac83f600a11eef68eae4b7690ecf17f7e50
Manifest digest:sha256:69941d9a0836dd3364dfa0cf14be83cf031f2f792125b56fe988ca4d8ab2e644
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:400a675794c1cd47c55ef8fe6f1bd60ae1137b29e75f2de2f5028d2b08d12c41 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:c91b615d5c08b2b3b31e3d56d2fdb01d8b6a70bc67f10ea9b712797ec7ea24ff |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:3cfa1aa7c7f5a89fdf1b68c1b80254ed924296970df368d1a64a04aecded2bd4 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:6ecadf0c564dd2ba33623fce15d96a84b7cbe719df57c14ac5d31f69b5fc2d38 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:89973387f853462cd587b9062b64dc7c1af40e570185054c42a0fb756f1f1406 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:79305d77ff7e09d083420130c0e1b2985a5c057ffbade32961be53e759c366ee |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:545f2a3b02bcfb580f7a72f8634c47bab0a54d4fe7ec4fb1d9fae25512825bcf |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:3a2de9d0f9b77065a1c2075c89a0510c88f74b6a5b0715106e7d3f3d88b1757a |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:731449e360b7068bf7b21acd11a4d9940ac2ee708e1aac63c6d7e9a63c02470a |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:1fa35b0982c9f7b5093fbe89980a2729219ad54ef4121152bb3a4739ca41e6ca |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:056f5dfcd55a474d0bdbdc45de852f14f5590d8a19f64fa8825ac5129a01d79a |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:108b9d8f138f5a67c422ca1572968d265043941bdec1660f2ba3b5f75502bbe5 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:9ba65e7521f77a1c53482f8d5e37ac1ddf89561d97d28d3d92ce0ec8e1e84dbd |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:a8729e9ec5c5b8be900cc60167ed54eba8659e5d345fe6045f626042dc173383 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:4b5a582c4b6ab2cadda2e7810ad0ae013867848229fac50d594789de9162b911 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:8cb13386fb1a9c1410c983216a1a9d9bac7d2fcf9aa9d17c97e842329660b9a3 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:922e6d73635b12e2ffb6ec556bcbb42117df7abe7ea6d23f43829bda0bc12f6a |