dhi.io/gitlab-runner
GitLab Runner 19.x (fips, dev)
19-debian-fips-dev, 19-debian13-fips-dev, 19-fips-dev, 19.5-debian-fips-dev, 19.5-debian13-fips-dev, 19.5-fips-dev, 19.5.2-debian-fips-dev, 19.5.2-debian13-fips-dev, 19.5.2-fips-dev
sha256:f68e869021142fe41684adfc6f92dc21bb6631a6392bed4f606c8d3ee138cbed
Manifest digest:sha256:c35702c2cac55f67c15797a72098fee3e99f5ce1d78e6ac6a112e9abe7cc7642
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:4bcf5384526a081c4702e1d9c735b22deb4af70b86c562a94714985c6e0b1f5d |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:d7b4f5e6c5643fb10518e668347250130718c8f63e290b4f66d953d5ac84bf38 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:a137f8c9049a1338857957fb0155c6b9f581c1b1dc73157eacd58b1cf4252c8c |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:bb27bc0bfaa85cfdd898cdbc2916c91fd9580a5ff6f082986f3cee5c485bb9c6 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:a4c7fc95f5819b3363bfaaa7540f8bf7d61ffae9207876c865f1519cbc671728 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:2e05247718629a5273c75e4cbbc58d4a309ad44faf44d7071d98cd7aa71e31b0 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:862a693cc0e28017b7b43284317d86c8db1f446a5fc1a2f362eef641d34a1382 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:c80e086e80ffaa1269e6bfd4f1bc35762219216ff307416a7f6897fb9fcd5808 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:fc71b371dbf801767d78729005ab4959420b37072393a914396ce95413673bc7 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:177690082afe4a3a1e8cef427f0dd363ef7f0bfbb7067ee301c09f90ec696f5e |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:22af93d264745fc107f072e0927e762e8dcfff3ce049fc8830e62e74557e5aca |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:5057d5cf07d9c46f4657594dfd0486debc46b857994016e92c8c3e53fb3cc080 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:d2a48a5e3ff3a57d5d59e5ad7aa2ae8a4bcec59c552042738b635c31b7de8bc3 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:bb44bcf09e0ccf65f824aa46fdfb8197f99a8fcddbb8ae5527633c3df40eccac |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:cade5c9e2d5f2a42d8541e7981530e284dba4835b3b26020a497a52df87eb06d |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:ad74ffcdf081343aa04d0112fe7a661802482a748b4a678cd990642a9a308fb8 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:6ca2ac6f3a1d0c0337e12aee8c44c4a22f8847a6e0963944e9bf9e28691a226f |