dhi.io/gitlab-runner
GitLab Runner 19.x (fips, dev)
19-debian-fips-dev, 19-debian13-fips-dev, 19-fips-dev, 19.4-debian-fips-dev, 19.4-debian13-fips-dev, 19.4-fips-dev, 19.4.1-debian-fips-dev, 19.4.1-debian13-fips-dev, 19.4.1-fips-dev
sha256:0609fbc78f57dd65fa38e3a6e3c2d1a261683ebc399abbeb4f860fd7cfe60044
Manifest digest:sha256:1fbb5ad3812cc0d3658025d7e7a21fdfec8e143d383f4da1c54adf524f4f4224
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:467fb5978f0f96f219790810bcba632d20362130bdffce9fe8ecea204ceaaf9e |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:8531fd3ca63e0dd296eea36d676e281cd29ddc4b54ef0457ed0d8daad8faefe0 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:677e399dfa6edb38676e96b9df2d2bda3d46cee5ac3c150869ec5fabd719997e |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:c3a6c4dd8135bc8db66b0703ab8f4eed1f8a802fbfc95979298f8f1abd8d513d |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:d98aa5e5bb6dd9815135d0c2de9d77866e4e554a7cf93b1fa158fc8ba537474b |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:9ac2ce0d8ec3fa1a23b4d21b1f64f4737959a4af939de331713e43d50c6fc579 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:a64ac603dd82aa5c66e62d083ade9d80c02f3a7b4f7bdbd36891a9cad6bd95bb |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:3a38277de1a17dc6e75104e829cd5749e230e5b4b9bc7c0e19fa712aec5b9913 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:9e237fd3434158fc85270b3858c8c9d29f260af6cc5fbf9d5a10839724ae4198 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:4bb1f57effe2a55338805419cfbfe25dd5f26373e6ead0ea91dbc96f28f1035e |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:e78911c4b61af93e7ebf5049aa349b37bc6d987454082f6d16e0f54310cbba91 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:74ee2932fa2d74dd05022d1253009777c62e48bb1cbe6c2bdcbb0ffac2e51220 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:a8b40fb722e93ce2425d4080466e17dc4d2e87ade53b2be0dff565ee80fb777e |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:77e0810263b9c1875998852adad823485dbd984b8e2d55d1ce156f0baca49698 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:78ada9b2afb8c4f4a1b4384d5676957c81e813fe329bf4bff95c99fa7572d28d |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:65754ec69824ba83e903f6f4f8b771554a47961c7ecd7d33949aff351419612f |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:a3ee1667154973143b0b0cff3b17fdecb5ba277c903da99aa909c3a0e57b4e49 |