dhi.io/gitlab-runner
GitLab Runner 19.x (fips)
19-debian-fips, 19-debian13-fips, 19-fips, 19.5-debian-fips, 19.5-debian13-fips, 19.5-fips, 19.5.2-debian-fips, 19.5.2-debian13-fips, 19.5.2-fips
sha256:e67aa5d74001c2ec91682bbc4aaba7776396a2da5e6f62a0cffa850880bcee44
Manifest digest:sha256:72d5ddaf7f57582b957eb5ec4391436c4808657d0fe6f58f86b63a68f3dad3d2
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:7ad9715a31cc9141be34c0c74e5bc59c7710581c1738a23a71191a607f7eb80d |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:11047da86cf1f7eb65fb5dfa83afdfd415c34665afe06090637121542f006edd |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:6c20c0e48af727706ac14322458f800f9a57a19ec2fb99daf632bbd0d5586bfe |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:e7fc12b5946990c7adf28c3d92653bff6100069cc2d2c4d961f92a71c64a1e99 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:a2aac1c228ef94ed99ba548d9566db1cbc8e6e97f45a406ec4086bf8ead529fd |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:54e2d1638ac44677603362ae7b0629594c407f2e563c1642c1597be2204e41f1 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:e86d39780ce9dc4ddea243bb7da07301ae053e455b834be47e9fb860cce459b4 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:9c26fa012aadf978bdf37f400da7e38af412837e25d4387121aada8aa0a007af |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:951dd2419da3f67b81e1873538aef2db9685b311daf3a74c086f77ad9cd4d74d |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:45945d68549a3ea3670d539b8f7819acc5bf022dfe5d072463f653845ada6c6f |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:5b70c354d21596b01a2efef167f1cb8a24233d857f8653f921cac51d13c61a4b |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:c3fbd8513baca35cba302b312c37945cf89a6636edaa4c1365fe0a741fe9db83 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:2f6349ff592761dd42f5f57a62093779629589801c21b6904966787f6a8f8bbc |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:33cb36eee94b0b73f9dc6fafd06e8bbb6b7e09cd0fbb55c36c109ffd60781895 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:b637f8296d25544c16ffb07826223358e91fefb1978a6aed0dfde8334a7bd447 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:cb4f6211fce6d3939170d3a7545c1d93d899fe49654c61c24431b4988979f3b8 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:f54b54e7265b3651e39e5eb6ba2990158e77fcfb75b84be0420502003d1eb508 |