dhi.io/gitlab-runner
GitLab Runner 18.x (fips)
18-debian-fips, 18-debian13-fips, 18-fips, 18.11-debian-fips, 18.11-debian13-fips, 18.11-fips, 18.11.4-debian-fips, 18.11.4-debian13-fips, 18.11.4-fips
sha256:0486b1a794499f1d5574ddadff71edb25494edaa451040299151afcc59a43eb5
Manifest digest:sha256:b058b60024a24df2e3d3a2acaa592903b6b69a46c426a7e9c5905ed6b947cf95
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:18-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:e747a8a3b56374eb82847cda74b3db1112446c289e49de5ace08e7bd65a65a6f |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:a3e580b1151af0a00c0d40347f7686fa1dcf87ce367883bf0c74450c2d6eae50 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:7df49448c8873e69379ff7f609b1a9a05f5ef5e0183181712c18281d5e885751 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:a517949c286c5615d86bebfbf475584d5a9ede2efa69d0e361a61728abf43293 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:f311adf4594770c27fda354e3207e16a72f09c1f68aa61a9c3081f2ec0ae82a6 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:f4478e9875629f20e4672db14205ae8a58c2e242f89aba2c841fce7f6924a7ff |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:59b4a028986e24f5fa29c69db22f36c86b2bfc8d442e727f1ca228cff0e44d4c |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:b07f12e2d82165cb34622ebd989e03e4dfa16d3e3e8985ab31e4cb82b49b515a |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:e1c1b041bfee54b02e9870e16c97d615e6923b08235a5ca103f0bba910901c8f |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:7fde6d93aa5970ed27a50b55e0cc2a901c8f3b59a396f0326400777d12989d7e |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:57d44a352ff893aa20bbfab58fd08b8b3e416fa5ed5635f4bd1ab8ac8dbce9a8 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:1e88bd0261acaf68b18f56f90a9f6b8f86e61ae637591c3fddd178b57115a650 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:d4ae2a8d5eeedc94677a1467902fc162658e0a727dafdced822bbedf33dea7d3 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:30249cd6325a66e16433e8fa1d8d69411095944695d83d1cc55da3f220d06381 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:6ce4ac0550baf1f02f2091eb2aecafb13f71dbe7852b50202881c0ae07a1ab34 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:33cefde7c03ebd982217a8d594e2081becbb22eb438fb1ab46a6b57f8185031e |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:f5da1439283018339e575a7f9beda9fe5538f5d54de906b3d03b5f45c51401f2 |