dhi.io/gitlab-runner
GitLab Runner 19.x (fips)
19-debian-fips, 19-debian13-fips, 19-fips, 19.5-debian-fips, 19.5-debian13-fips, 19.5-fips, 19.5.2-debian-fips, 19.5.2-debian13-fips, 19.5.2-fips
sha256:02280d9511ceaf1c322f5b6f98303da064f9118cd5ce9d958cc6e6c44cb93fb3
Manifest digest:sha256:368809833ebbac8c58022b30667972fd717feaff270e906f27f13cb39751bfee
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:e42f49c0638ad516bf559c961f15dcd28059fdfb3677e3a4e7854f8baa472705 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:9fab2b657f58b0d5da5bdb0d707801706eacf085f650454fe4b3bc5e42e4a865 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:ac10f7790ba4c4f99c98f62e3bb809e5c87eb2903300ac86da96b081db5e3e1f |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:69f155bf994e692bd2a804d674a4501510e66cfbe89813bb1abf75d769cd3bdb |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:12ab2e68108042f6f394d454366eb24bc86fc63f2cd8c8d462c3df4dd31a3fe9 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:474c345c50e6d4249dadb3db08536bc4e4eb86eac98b2ab7fa09e529c95190cb |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:2fde848ab686da3b25cafe8268ca1855eab834c1eb8eb8966d2288052bc29024 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:3dcbf0b79a17415bdb28936e979fabc23614b909b09826c792e4b5183611f1ba |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:0bf0d7ee9381e47278a9895821b60103edcbd9bbf65bb0ce40dc18e77c48a0ea |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:bc98247a1c8fe4aa45c8024fe08c8591b9730344e1504277939bded8eef26caf |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:f5957c8dc968b9395621811e00a2db24a99df22844366bdabf2dd1de8bb2a075 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:4ff744941cf2d41c76f3e46d9126b19aa7097f0087ad9e04d3c030adfadb78cb |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:1da68ec2b293287d78b32a1b4ca6e74909c0161cfef8c04ba33d7ddfea12d009 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:3d243228b41427d919289f5dcc0e70c2a7a0bae283c7c56a753a248753b7da92 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:1fb6f6f4612de8d21efa401a6ca27fbd07bff6992da83a5e70c369087e58cc56 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:6bf48155f44305dbebdd3afe083be14de3778e81a896da78263d569e8d8c4fbd |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:d0359193c84ed1102db0d256ea2e1a0f4f33ba6987d9abbf91950a38544c4985 |