dhi.io/gitlab-runner
GitLab Runner 19.x (fips, dev)
19-debian-fips-dev, 19-debian13-fips-dev, 19-fips-dev, 19.5-debian-fips-dev, 19.5-debian13-fips-dev, 19.5-fips-dev, 19.5.0-debian-fips-dev, 19.5.0-debian13-fips-dev, 19.5.0-fips-dev
sha256:cf9709b0860019d32c230100f153f4a9e3930f90ee33de00b1005f51db7fca1e
Manifest digest:sha256:e54342f09816cedd01f9c3efe3016cacccf8c6d297ba4075390f746436292a04
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:5dcdef01fa99ba01656546c647920f19078754f658a05a2a20f4c6c5fd374ff4 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:b10aaef4f99b4fd2326af189c730fecba0991a9b51cc4da26f92cc8df26d7264 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:dee774b368bc6c1142de9ab0d6c787b421aa6394d2bfae1348a15b5019de5f86 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:0074ecf17aba741e2e3979e68852d2ce5f5b980334edd2deb79a9840974f0fe1 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:4b74d7b5febf1950da9660e5f98bdb742e1e960950fd94548997f5886e480c6b |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:ffc875ebdd65a0d66da1ab325f1f719b7726264ba912740b0e9ee684e22e2c70 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:1648ab0d2adfc806befb4a470e443b7d8555d8a9f31ba6584dcdc1f8412971ed |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:484a69ffe2f7565e09242f44ae530cb905c8aac0d07acbfa4b519f86ea20a299 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:c9cf25546277817cfb7f5314e0fb12e537a404bf570c92b0ac714be4698aedfe |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:4b232722778f097d5695dea46955dadfd6611e616d31c79484ed197ee1c2be18 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:43cd628feeb9122a85fda67f29de1c32fe312566145872a76e8da9b9015a7ca3 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:819014479c24162f3a2c6ee4e21c0982a1bf3721f7091102e9e74789e67206c2 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:a612286db916dbdba6a1f79d47283048340d0ad068bb0577289e5a6666e5d9e0 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:6dea2b4b4d16495c3a71c09b33ead451fee8e5f81c3284bbe5a8bbb8438a6707 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:bd5a090169fc65a703815fadf3810504ee8bec8bff69a33acec4a7298e746f64 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:0065b9b268de334419d94bbe18f68910dfe1df235c5533332a0b8fe218ed9041 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:76a6ccf02b6b1fa9755facc9e4bad69aa7ac49f8ebd9b7f2c6d107dde0d79fdf |