dhi.io/gitlab-runner
GitLab Runner 19.x
19, 19-debian, 19-debian13, 19.5, 19.5-debian, 19.5-debian13, 19.5.2, 19.5.2-debian, 19.5.2-debian13
sha256:5c194b288df849cca2d2cec900bf5d22dc083770705e93660565c06cae6b9740
Manifest digest:sha256:19be0fcc3fc52a4c2be73778618ad2f6ccc0b1b3139eaf427b4bb3afece69272
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:192. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:edfa78f79a1d1033d65cc799d871501178185aec8472db66472ea939e1de7497 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:a09e5fe57805fb4d08bf9c421825c6f2c660c57e2af962de157d8c9ce94ceb7c |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:054ee161c7ae54962d93912fe4b1db420dd010ee00fdab1a587d2a28836e5bc6 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:5c5f7839728042f91c54d13dfda4c8b446bb154d92f0a519346912ea352a4543 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:f1a8a684dfe6e0e51d0085c3cda9e19cb7925ee70fe06d9e8e0435bc500938c3 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:e8238e3f9068af750cda6fc961eb70a926d86145e9cf4564af089bbaec4110ee |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:f05a348d765faafd26949c23319262be7d62c9623eaad6d07f5b641d2e749575 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:ae16dcd036c9db64624621e6bb6feace91d9990708e20df5d04750bbe6131666 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:2fc512b098bf7eb7f10aa26a55da32596fd12b60443b3bb6f960026dac7fbd62 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:f6299b213815405ac4b41cf89d6d41ea4f1a78ec6e5e0c86ff543206147d0637 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:2dcc71058d96df96e7a3edaa2237abf3f3d5ba0a85b19d3c09fe227feb2c53a4 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:264d9be9508b8725017272733722086619080ed9c5f62ca7d3614d8bf3ff10e0 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:c8e1a4368345aa96c8b8be454c252560afd4496b7c4faa0e6209d986d9532c9c |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:13f9d71eb678fe3b0c003d1d1f45bd1aa0830e4c4aa044cada6f3b51d42ea501 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:4a9550608d129b167bc2ba80664cffe9c314cf6cdd533ed2ff612b0910d46ddc |