dhi.io/gitlab-runner
GitLab Runner 18.x (fips)
18-debian-fips, 18-debian13-fips, 18-fips, 18.11-debian-fips, 18.11-debian13-fips, 18.11-fips, 18.11.4-debian-fips, 18.11.4-debian13-fips, 18.11.4-fips
sha256:908f02d8893469d19694404d0e4672172d7493c32fe658df93a6a6b762e1a772
Manifest digest:sha256:b7b9d541d500cfa6eeb98e26bd2411c8554979067d71163e9919f4336d9ab96c
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:18-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:4a21f3c66ecfb40457adc1bb37533c6314ec609b13c1adddb2d28bde361d5739 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:fbfaa552d6236f46a85f3fbeae8ab86a496fe2e3f9ea0ee7f0dec584384dce94 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:cd225aa9750c6c74a45e5374fc4e8136b291d8326310bd0c13fee821fa44a6ff |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:65c4630c21fb10670222fee1af33794750c7266b6309516ba4582098cbf9c281 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:343f92ad585cce0456253e2a9ee36c81f53d7a1d85eec98bc5c2d082bfa65ffe |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:e8d432bf615fb3ebdbf1a1212a737bb25b0386a001a08fd3904aa5ec6b0dc499 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:0ec86d8163832f35a3d6495494c2ef56aa9a9198b9a200b2c846a38987bcd7da |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:34c11780393e688ca57bc73bb3568dcc5abc7f12d118bbb9d2f3a656237d8b03 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:6930620475d47aacf50d41de95f8b4af30b2d140c021be69e1679db9c4ef6c67 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:94fb2729675e6542a8ec65118df6527ec357428329593a0b919eca78f59b8667 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:7ad1a6dda422b1e72b827f225aca31d5103695652308b509618f5f25f133afe1 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:9be0d34d4183f0de3c383971dd0d751a28b03825d3d888bc7e56d4bd922210c3 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:a1a556f6e1e6d70dab2fcb3d67b58f2e0e7c348feb7a00436535409c04ff5510 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:a026f6919eff8fb313b3005c4408005f2021f7122e030ac7b249b98e0ff66857 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:e5c1435cffa5ee7c4dc0ddd8aff701885119d6d7b23d8f2359e1e80143e80467 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:9a1b56b2904fb8fb0b0b619fd0d02eecc6527ab920255682650dad1d883feff5 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:cb73b83d00e59ed9582237441474d85ade0d287a3f9ca907a2ea222d7c61566a |