dhi.io/gitlab-runner
GitLab Runner 19.x
19, 19-debian, 19-debian13, 19.5, 19.5-debian, 19.5-debian13, 19.5.2, 19.5.2-debian, 19.5.2-debian13
sha256:1e23b378d8aad6274f6151e983a727940bf068224e06d8c3159063d7cb442c79
Manifest digest:sha256:ba392bde0f774c88990e9693d1a2f71cc24997e806f19b45954c620672ce4621
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:192. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:a9bcd98dbbc6b6291aaa8985f65be0ea93711acaf8777acf0464a18b15c0ef0f |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:5c245d4f9c2527a4cb72a43243358bcefad6112bf50ca6ecec1d4676ecb187dc |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:038f1f9d527fdc12ae60db00275d38d7d8e15651820113a4cb6feee81aedd267 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:0b8d880e2c89c8b76b4e517db5d6daa95eb8ea712f771064cba60a1c36059703 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:c4128ffad22e364d1add9d9567c99acb8bc10eeece98fc04275a0bd05f3426d3 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:ad60219326ed242b97226f476d0d23686cca86ce49850d2bf8e430da7ebca99f |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:9cb623b8c1fae386339bcd4ff4aa103c983793e30a9f0a976f1258075a6d411a |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:89affee0d8b2524c1945107a03e21ee5ae833ab42691fcd9e0a89e25bcbadc3e |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:4f5c5f4d78318a3dffc0057b3acfde8ef0d2227e75491aed1046e77b1fa5c40a |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:891b506599a01c56d57bdeee9ff15e60d96006b5839243cb503f47ecb0d60119 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:b526867d11439fc9a8ecc3f1776de49719ea3de9f407aed67d0c073588f43ea6 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:4c07468e020e695701fd4c63a86428280e0b465e97a0e9e1bb5bb3e1d7b3c480 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:50ad2e625c76f67e287e194cfe69b554554faa6f0f905646beaeca362ea8ec0e |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:68979ec06df184e9483b7d6a1f1955ee843b6035fb0330eb6771defe433f5fad |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:172092ed9d720fe2ff67013f417d9d84783bcb21643805cb5083f754b0b4ad91 |