dhi.io/gitlab-runner
GitLab Runner 18.x
18, 18-debian, 18-debian13, 18.11, 18.11-debian, 18.11-debian13, 18.11.4, 18.11.4-debian, 18.11.4-debian13
sha256:f72778c54a8479772066f79e748a04de5e0c332f0afbcc8ad7d42e33e969dab3
Manifest digest:sha256:30fb89bad6cd2a2403eff13e7a6599f00369beafa7fa7241a0fe626d7c5c1079
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:182. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:1a35826369589bb1869312a34f5ce8e03aea4acb6b0d2cdb4b17c1a68b9a6595 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:59332a22646b713788434e59bf794ffab872cd0f1c09c124d4d8a0236185eddb |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:696b00cafe9ca3c1d549a2efe4c69619ef9ec5393076c2d1d05142a07bd79f79 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:cbb35e347af47d3147e88cc10028113827a0a8cb374a920df59a0639e6a07340 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:961b123b3ed2f3123abb32ec0f20a4a5a38620e9e48bfeb7b58fb526c7763392 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:4b8504fb42fd4e8acae710b979d7d181d47b134b65d3daaf0b3bd5f0403ecae9 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:dfdd66808aebdfa18f9079d71187f8ba35fdfcbc380e5ec38f63ad85e02a6553 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:04c2e975231a8507e6b20b225618919144adbbb0ac7cc356cb12ee1625ab522b |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:b1550453a87f8ff528b4928e9c039926eaada9affaaedcc8b092589f231a0e3e |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:a31ddb3661afdd5874e7a547b2a948725d173b0ce115f7a7c93e6d24b8005855 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:1f9a6531469fe08061fb1b33af6302b749718c7c34134756c9b1f21571f5c63e |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:8ab964aefffc016b9f9a13fde7ff7772f2486d4a4ce9e590f69ed74408237561 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:3096e12fcae189ecc31a6aef9ee65cdc1af41495d2d108cb9abaf633a4874463 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:15d9d3dded1d649b79e7ef9d7e8504c8a48d9cc72fca77d892d0e8b841f4db93 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:d4782f11ee114f54efd9655ec5054b1772f5ba2de6525322466443a4e793ad95 |