dhi.io/gitlab-runner
GitLab Runner 19.x
19, 19-debian, 19-debian13, 19.5, 19.5-debian, 19.5-debian13, 19.5.2, 19.5.2-debian, 19.5.2-debian13
sha256:946ceec15c47772f7cb1c28903056595f690621e680b6766b2973a3333d54e1a
Manifest digest:sha256:359457b010e79ce5b8a5e4fdc45c01b0a6ad27f973c597f4df69fc5ab1236a1c
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:192. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:cb4685661f3c1369c80e4a81e9137ef1a75dcfac5c81da581bd659c82fa6f35f |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:228f468c5ab0b977975642ac7ccaeaabe20095a0e92d04f8df35e50e9aefd469 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:1bf32f7957e4281cf4e6ec3c70be843ebab652daf04feae2cbf8ec3b311308b1 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:e5d32d8c050e53257e4889670d87c522647adf0c3115a5d65c1c538f2f973e05 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:664319ec275293d70660cd6a730cae9b16b2ec4230e4a03e7640a6b0e042aaae |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:f09874ceb3b9a51791e9952256c4ffef6a9b010a270f3a9af141f9a2466b6bf6 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:a592e37c39949a9057157150e84c57cec8f1c33136f89327bb1799aa310a01ff |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:7f2e058a2606f93d579646a90ee099a9dfbbb1688ba0044aeb22884c2b6c6ee0 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:24045b0c33b0cfd0e57c9d779902b985e1cc467a4ded4740a4cf7e21af7ba353 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:06d4bb30178350e6b90221081d37953683b96cf27b4303e368b1d4a955256c0a |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:ac73989314e6a7e85b3fda2d636b733bb54953de08d45406a01da53bdb8a5ece |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:136ef059c7d98ef98882ffe9eefcd5300f3ccb6f0ddda6826a134f14d36d791c |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:21284b7661a7a316ade3a3b3d8652f322b8d6b938f4b9b32cbfdcd1bed13b8b5 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:1cb9e393bbf5dee5ec5054a8db601e04f128ab9c466658494ea7d5384c8f198e |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:9bf2603b9a24cd91b60afd5f215577dd1ffddb08da586e38233b7d01eec6b19a |