dhi.io/gitlab-runner
GitLab Runner 19.x
19, 19-debian, 19-debian13, 19.5, 19.5-debian, 19.5-debian13, 19.5.2, 19.5.2-debian, 19.5.2-debian13
sha256:05e7a2475d3359251b3eade56dce6e754c4ac805c42439f31156dd1bc71ec844
Manifest digest:sha256:43762bb8a05b5a8a704324280c2739f37899989a8a71efd622d6717ccd1e6f39
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:192. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:7f6b941ea9178e28b5ac520b9762eb45a6195fcc718fde8948de2f0030381491 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:73f8f7ef63404aaf63e48b427a4fd0b47290b34d244f34be4b46b47cb5845b37 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:ef4d334f192244b1e702d6683225c6a4624654190db6a1df1386a4a15569f8ac |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:88a92b4776eb756e047493ba7de0e3a9d866402c827fdd781197ec21c736cb49 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:2721183203f9580fcb60110bcf858fca4ea3c0d2d5ad80e591bf6a352f252879 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:00d9cc33f13e2a81bd97201ccc34658fa838fab8143ee862d1972a4a9b3680b5 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:57af309585aee499c6018ad65d3d120d75bf26eddfb591310cdf85558d7b964c |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:b7f75c957e30952a9504e7afeb230f91bbc1840d057d4eaa4fae29a47abe25b9 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:973f658f6a8f38ac1b77dd6b686285bc73b4757c236140243c8b94c48bfd02bd |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:1d0e5105d03db1634f0c0e9fb2dbad1d23f3f94c6fa3249e646cf5c03e8062a3 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:01bf1c78777de655d30361c6cacedeb012e9bc036e90e12dab163ac45cbfb1df |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:50f095626f29a04a4a32445ff6c231906f2e666af30cb077cc551472f7cd6287 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:8158f7d7fc3cf3825125fb2b8206275c86ba73a3fc7d980065e5f45c44d7d2ee |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:fc17ae897b902402c615660cef23e0777a9221cfda1206d8f6df3ddb57432b74 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:c9a744f0f67ba8c76edbb1a8e78f33f2a4f60a3745e0be826e73cd71bd110bd9 |