dhi.io/gitlab-runner
GitLab Runner 19.x (dev)
19-debian-dev, 19-debian13-dev, 19-dev, 19.5-debian-dev, 19.5-debian13-dev, 19.5-dev, 19.5.0-debian-dev, 19.5.0-debian13-dev, 19.5.0-dev
sha256:16fc42a1abf88b45e6abc4f6d712883aee9835b8d272d7402d86e031ae949edc
Manifest digest:sha256:bc1197121ae3c246a15b54c8827336d77df415bf487ecbabd3c9d5242c0b20f4
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:71c9e2513f8e20146ac2371b5121a7a814f5858b303349d0d2a71deb83d16503 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:cca1a0b6d8dc295bc4bc6bbcd368800d0ea326c9b2eefcd3672172a6e963e635 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:5e02be5f219495281ed7e735da7c7bca87d8f0be71110d1d95402f38ccc0de50 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:f2f25b8d57c4e197b81ce15544eb2ec72e261bb35b937f3f5711e294f6e5a2d3 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:d01b8b8d991a9da7d3747e0d6e01542643146eaae1826151519aa5878e57717e |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:de33ee4bd4079667b1a7cc9587ee6027f0b71f2bf858d2ed67d47eead9802fbf |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:c18715599a2b1d50f64a43fb3df7bb65d24b5319bf5cf0abe329361ed542f578 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:c78bd960b1e6aa8970d250961fa23cc96b1345f761d2e71938bbebf5b18dec75 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:223081db03915618f4457c160924c546114de85c95573a1bd6176fca823a5127 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:e8a5d614a7253a03d720df586a791f80a74310cb5091812f5ecc9f77e6b459a9 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:5685e76e679a5b7e97b851f24f7fadfe6c159421ae2f9b556ae23d21850cd8a5 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:e06a6d066b90bdfeaa5f95d3140ec7486e8c0d18e06eb520492753bb58c83bac |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:dcd6710a3bc4da523428d806513377e65141a2bc8837593a56706501bb6ac104 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:d775d3a7e1a0b81eb6f1219dd89414c5720263ebb820ca83dca0954e639b3147 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:20d941ba035d30007d7d57f62e34fde3ff2201d08d76b1c46208ea50de9124b1 |