dhi.io/gitlab-runner
GitLab Runner 18.x (fips, dev)
18-debian-fips-dev, 18-debian13-fips-dev, 18-fips-dev, 18.11-debian-fips-dev, 18.11-debian13-fips-dev, 18.11-fips-dev, 18.11.4-debian-fips-dev, 18.11.4-debian13-fips-dev, 18.11.4-fips-dev
sha256:b79557ab446a7ad60fb40641ffcf1751cd9c8a9cb9380a4e7c6e098b7d06f99b
Manifest digest:sha256:3f3f440155197064d4775bb46edfe4678ca8ee33b885f8fa4ec0ab2436f1a783
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:18-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:a711411b8e67534e8676b1ed3de11e827770e49351f3dcc273d05c5226b8c017 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:ff3d924567ca4bfcc7f7a1fb9402334df24051ffd9e9171c19cfb37c6068a534 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:0b25456853ebfae8d6285bbe4588b847780cac17f1a7bfe4ede56f45656d2326 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:a9b6c7befad99121de296c2db5b69883bda4ee75a573c1db92c65ca4c83e536f |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:3716393aea5e6d87f5e4c37c63f49ef7c864ebd5dd2680734b1804c3fed8ee27 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:70977ee8a0ded827cf8a74ebce1c3c7d463ff454e543ab40d7a0f64f20cdf7aa |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:ed6f092cccf9133af229151884eb8ffbd5c7bc5043cb8968557d7822d6024945 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:29a07be1e67acd9f7fd0f96372a2f546463759b867cef7aa7ec0bab6c2bf5fb0 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:3624386d586a4c76392d4a9bc98d5d6a559178dfae35c79a5d02b2bcd311780f |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:208b8f4614881714c68ff2d99d8b10b45dfdfa527e848df3c68f504455305820 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:7b9a085f307716b3f4fcb76e1cb64bf4f39dc48c4473c59750f25097bab91545 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:68354d5c92da1060c93fb77baa7d3ca0594a891e7e2d8e39f05f15d051140e82 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:eb9721fb19eee94da8c7fe6a3182a464a558117df7dca8a2eeda55f39943740e |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:32dba1b97bc966882c3297b26c81c844b0bb6e94515e88a5a3cccaf99b458a5d |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:63638fa173726f0c44376975007479379ae545e0bb8afc7350c413640836441d |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:9988a5c5858fee332c638c2b85ddfdd22da372889ffca321bc3f77acb6f3e1a9 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:2ec3897409d12f61453bec78a32389ed333278403ec0868834460ba4771ef15e |