dhi.io/gitlab-runner
GitLab Runner 19.x (fips)
19-debian-fips, 19-debian13-fips, 19-fips, 19.5-debian-fips, 19.5-debian13-fips, 19.5-fips, 19.5.2-debian-fips, 19.5.2-debian13-fips, 19.5.2-fips
sha256:90b20628a284fa4a50c3dea80f22d2fc0a7323c470613727341bb1fdf4d66354
Manifest digest:sha256:6e60ea6e4d69cf2c9c69b0e1f3d39e54fb91774594675156192f8d4de5fd9fea
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:964f703c4c6eaef0bf97eaeac34fd8ca0d771ed445052c75b48a204ae00758d9 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:1908817315d450cdec876f85bb1dd1607592b2491c10734cf11b9f645d8ebabe |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:3dcf9c1408a179b6faab51b50c60fe6fac6c661d22fb1b905de743de7c826e18 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:8194f79636039cfbc3aeb3dc797945db06c98a600780ddf5b792977f978fdb80 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:3c2b9ce2553adc6829c8419ba20797df49d93cbf2f0f1add1b13eba72498d813 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:74cf82e160ffbe339d26e80ba64c8c7f4f26b29b164ea4753cfdf3af7799889f |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:a02df58b01194b7aa4d120c75c68675b19b90fc2a6284aa1f8bd38cadba8a7d0 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:4b2cc2eeda99dc1ee8007fb401dc3563281c067e9be66ef6bb448447b93194bb |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:27e8c469d32fbc07069403ac7d6ae8ed82b28a22872ed4b26a9b4fc5586695de |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:b7253ace2a7c4cc88e87911104ccadafb5a543cda21e8a3f36743b9c8abe5b7a |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:5e20adb352b894982b83c58d3f90b6428a85286c89b62f36b78358828d72f130 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:290046bc961ba928706970ddbbecacbc5bd4a0863cb0b2ab6775b6f645744153 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:0c4a7b61fb894994c9240a6e39394cd77b1931c41c2be5ebbe65ec5be74f2583 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:5041d1653492d2b25fee6cb7b1406b7df8e9b1b69cb505cbfc4a0ea244891841 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:361cf85acc8f6e7c2e60939e2ada4990ca85dcaec5055d126afdc41dbf4d3291 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:e56f12776c72907502646907010d39ae06ff4611d45450bfb1b9cfda649fd8ee |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:4ba6f2c746c2272a5e08db28fe83613307c720d183e2ea21806e4c3d2ed544b0 |