dhi.io/gitlab-runner
GitLab Runner 19.x (dev)
19-debian-dev, 19-debian13-dev, 19-dev, 19.3-debian-dev, 19.3-debian13-dev, 19.3-dev, 19.3.1-debian-dev, 19.3.1-debian13-dev, 19.3.1-dev
sha256:44e6a6f60177b1cb04d85d899297b9d201532370f2af9dfa1be510d1526c37ef
Manifest digest:sha256:53778c95d5a8b9769700405d05ff79aaba898a0f9d00bc205cca1a0aae0826d2
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:29bb73b5cc524b9f4dd0f647377e5e04209190eab8db91f8be39e1dae810452a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:59981773617685f6a6cf4ca1f9ea00c4eb582a8948daeb6b3f2786c997546490 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:ad58e1d898a0dc218589c8d03ab633ad7a0b83320fb094e0d7e1db26f4fae4f9 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:20138819fa78896d5d52c53549e29a17948a1159380306d00ed126f3d0ef8efb |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:1de1cf6ff08a1c5e0f77676fd56ec75449fcc2f3c95a5245d611b954a2d84ff9 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:9a1af924d600bd79decb87916976ec4dfa2771fb16f0df9f726490fff225cc73 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:7c7cfef64ff0a83053b45a2449c884a04ad53e25d886d392b64af2758f495490 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:854b1412e882841d655f894e0fe84262eca18532502e7f7eba9ea67e8043bcbe |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:1615e33a3e3e8c2e86266e4878d830569cabd18e9e1b68230ebfaa5f79484594 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:3a0dc93b869429a7fa86d536924f7e384aa199c097902019be885ef48e31f8a5 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:8c72de1fee6731f7215ba77c44c547f3bcbc4461420555bfd4982cd5b0452db7 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:d9b662ce56ccaf5fcf6d7e54d751cd0163aae9658f121a0bcf88f94dbc3aa1c6 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:1bf4b6c9a90c56661efbb897321905063558945900a874834da7aff7d71f235c |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:15e011d1a79704a821fed91f86917194cc73feb71d201953ac1b3461c1f9e467 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:f19acfe6acd3846baccc0cc3cad77754539673b8c5a886e10398170c79134630 |