dhi.io/gitlab-runner
GitLab Runner 18.x (fips)
18-debian-fips, 18-debian13-fips, 18-fips, 18.11-debian-fips, 18.11-debian13-fips, 18.11-fips, 18.11.4-debian-fips, 18.11.4-debian13-fips, 18.11.4-fips
sha256:442ab0ab916d840db36f656bb4e06bcf047fec80b4584dc1b8a8418c3f61ad5e
Manifest digest:sha256:0d1dfc8f278fc24b5de7fa54e6b069d18dcfeb6ffa63f813d140634888c15b9b
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:18-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:7986b6053d3cbc96c8023dd493d3a64c0fa09237cef370853c1003ad8af84267 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:cab82b2189531697b99321254b5307e22cb5008d117bc6971af87a77c9c9d8c6 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:650485a8a77b21acaefc1d8c03eae632010d7d8f63660de0059680711a01f333 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:f9fc86c625854f023b5ad86dc4e3e0df07efb4ae6bdacdc960673ee3879cf1c0 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:3d2fa8e97d0eeb97d1f8cf5f5de3d8c8701f07ac336a52838dde85a781d5def8 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:768dcd2c8e20f24738bfe2e38694224f2de8d9bbfb6ff81da4200491755da536 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:556f2e4fa3e4013bbf6866f9720117afdbadff102ce2808cb8c998bfe072444c |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:12958f3cb3f8e1a7d997f43057821a2fa0e79d39b3bd9cda4c645c08f6ce94c4 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:79ea2547378487cc329b749880cf15a3b39c739c204996130bebf1fe3f75f5a3 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:29985cdc3f8e1cec01211b415ee58ab9838138f21741151b1c50a25b1703423e |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:da8770a5e7d13c6c66659ba465c6be184f1415bddf0646faa1108593ed17f01a |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:853a0c1accf948ee40540974e8e57693d14ef3e4937a24657dee571721b6f484 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:9fa0aec88209028e8032c7ad6d162b18b2f3a5a58d1731ca46974f8fedc83efb |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:052ba6d11c07698592c801f898c85ebacae7352892cb4ca9d1a1fab2c537239e |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:1aed997b4afecf1130756e8c409baefc31f865b9a1ce81937c8955deadf6c098 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:34b8e891eb8fcc1db3b329c8cf4c686f1e399930eaca35e21b248604d1de0ca1 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:c77ddf8382589e5446c517ac60c83b6b7bc612a91db32f791437a71b38380830 |