dhi.io/gitlab-runner
GitLab Runner 19.x (fips)
19-debian-fips, 19-debian13-fips, 19-fips, 19.5-debian-fips, 19.5-debian13-fips, 19.5-fips, 19.5.2-debian-fips, 19.5.2-debian13-fips, 19.5.2-fips
sha256:cb7ae226ffc0e2341ec2d834b4cc645d1cb310a15429e429f79130fa0fad8795
Manifest digest:sha256:2ebd9a8eadb360b6d7ace71c7db8deb9286382ce006840a7174b802a6d3d6b32
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:d0e3caaa3f22979f199e7c57f344b65e51dabf1ec2d89709cfd3944783ae4665 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:1c01f6a8f0ffcb6cdd0216b7dd07c98fab8be736df2aa355208cdcfd569defd0 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:449c5dfe374a15bb8e27f1a3a2bd962ec2e91d80d71ced5e52474fd1b14fc874 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:a7692739b4bb5719db7225d5288ac37e36f87f654cb6f8d11972603da2695c4f |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:e3e90d3d5af7c59137b5873270226459baa0343c151c00bd96e4776f5d4b5468 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:e7ce470e418c6014be81a7e3468aa6df9ac0f3de301746b9842d8d2397749719 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:8bde97ea8174d118dde0292e1652f18953a8caca18c954e3b8385265368a0ffd |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:fe3899b2d5725ab86e7e3b781db753b15199ed6f3ded402bd540d4dfe5c63b80 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:19b67a63b3bebe6887bc6c6df779e9650bc81e016e799ef9b9a439b09e2ddd56 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:9d1923ae1d7e4139c3d9183d67f4cb5e058b3b7c34b82267a76c55ac0274223e |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:046e619cd3241320aa173e1ae251878013c8e37950aa98411bd60e533678b53d |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:f15def72b4c5b25c4792a8d187960b9fa45c3d92da37448b0346f05b55e3250c |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:0cba7395fd7033cdeef8a54ae4cbe84a9e920b49b0efc052e1ea2ad84d0e48fc |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:44d9c6d215533bb8fcaeab7896452200eb1c9eeeb3e26d5307649b485c96a091 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:8d538743aa8217004f0ac550cf60e1a6d75e5b3269a20c55e8f87e168461910d |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:fefd369a832f4626264202985fa4bd4feed1a523d52df43c87abc2fa6e2590f4 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:ead64c20b06f4c5745015a8e068c9751caa1537c76388b9af9ef8fa8db5f1bd0 |