dhi.io/gitlab-runner
GitLab Runner 19.x (fips)
19-debian-fips, 19-debian13-fips, 19-fips, 19.5-debian-fips, 19.5-debian13-fips, 19.5-fips, 19.5.2-debian-fips, 19.5.2-debian13-fips, 19.5.2-fips
sha256:d3c292dd2efb6cb04618863bf410402d0aa30207d7dd186361a7e6906a21c46a
Manifest digest:sha256:e61cbbe887f16051cb0b5639df36e35d5890a1045bfb0d3439266ecc7987c5a6
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:511ea7f0708c0affe62d1b07140129eca72763c6f15fc5c9169f198cab6dd880 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:1259ba484e7ed4a827b31b83130835cf8ff749878e821f0211aa29c41a69467e |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:994c76cbce6fda0a00dba6e4e4ec1c58e59024d72487fadb49e5a29d333cc1b3 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:6cb7b2c84a2236d514e4b00e4cf199bc5fd2e57989657fb8293065b0bb49150f |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:80a23fe7cd7cd69ecfdf7bb3d0d7bf1fa1f8ba892af53dcaa54b1ff8bc103476 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:58b3df9d913f8fc67e4bee1210669e8b2863d922f36c84d4483c1d9f349ce032 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:405c2008aa85f61cc07b07b5ad3332ee1d46a7f36ec9d7c6978ed6c20ae47a9e |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:c6eb378803e7dba69597b705d180481c2651cd95980edb018fd6cdb21a12b826 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:cf1788f3a58df157d5922650f6d59c9f0ec1ae52c5ea4060108dbc39dfd7c8c6 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:4c76d35480dfe3320834c5b3165f7fc3b98afcb5cc8f98bcad93d4035a65fbc2 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:aef1e8e05275238de7f3b39a11ad07fa226bf2359592b16e030582b6d7eec22b |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:4935236f36691632e2425128fa1c62d6110b69a763fcf14ed6db919b55472fc2 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:1b7e5abea16ab980c2437cb1280371d153ef48fcfa940b8f22dc9fd16898603d |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:5efab261a1f6e7b8626990025f08cd96fba3657330953b3d02fdb93d981968b4 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:aee079b45955d49c4d6e00d97540d3f59b827d8faaa74181dfff62e021d2925b |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:df91c0223a5e0128a454330d78981fc1b1727255c3c5cc807be09685ba0fa997 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:2dcb4d238eae190f2425b288ddccb9e395e3e0326b77b826da1ed5e376557b99 |