dhi.io/gitlab-runner
GitLab Runner 19.x (fips)
19-debian-fips, 19-debian13-fips, 19-fips, 19.5-debian-fips, 19.5-debian13-fips, 19.5-fips, 19.5.2-debian-fips, 19.5.2-debian13-fips, 19.5.2-fips
sha256:44cf1ac4bde8eb39e198569daf6bec09fb54e240fd3dbd3a204391d932857460
Manifest digest:sha256:12a8e747cfefe751c4aced066b4efde789aaa86ffcaf5f339828133f9a391d1e
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:70079294ec36ee9a1874118ec8f5563adaf61a4a6bc7b293b5e7d83408f4ae70 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:3dc2451d4bf1a04a40767f02db05502999bdfa9d723dcd675d7602106bb827a6 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:c19dbf83664c4f03ac9a6134c79611ae65d9b7e1ad09056517c7102d79e7c1ba |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:5ca2739d247958d054212edd1c446be113b21a7e8da96aca3b8e5fa0f23c5294 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:210da7a9ccfc581f5467ce2010f10ca4af589d0ee2ec3e5410624ab4a71472bf |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:c304ca37ba166839dfc88670d88b5a3281c33f6b17d946313b7c7257c900d4c0 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:bc8eed68c59f72cb60a975b4663a93a585fb7fdcf6d1c7e4a450af3a65a58c93 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:11be518509f5c6c1414063cdc693c19edc0a8795950d6bc9f22981bdfdc56109 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:2c868dd67954536496ef6ac77287a57c1dcb926ae451476893e47310d797e713 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:a41df91e39feb5ac47e6eb37386ea3d2ec79a5c64bae9b8ef6623993ccb52a35 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:ab5fa09adf52ef93c76fd1e8193beab05ad0e41d81f386444d581fd1872a6e0d |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:3bfaa839016c86ee5d0b6a32b3cec0c271518a1fa0255c69c244c6396942acc7 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:cc2da68aa64d3c556921d34be7bb2a81a01eab11f481497707dfd54d2e95fbfb |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:00c95ec236924cf13cded7deb27031cce4da615116f4fca749836dde08656122 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:8c7179fa4ea6fc7172dcd464ab9db848bb6e256c6248f74a5d662a970aa319ee |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:af7e3e60c5eb641b731822a7b28f5a5137fa0ddb2cb115ee9de57addf5a97b90 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:685fd2f6f1de046a0a5950eb2b59c8dd2cf4bdaee451408cbf7b004f4f2828f0 |