dhi.io/gitlab-runner
GitLab Runner 19.x
19, 19-debian, 19-debian13, 19.3, 19.3-debian, 19.3-debian13, 19.3.1, 19.3.1-debian, 19.3.1-debian13
sha256:d965bff116d977c61bf4d794b43e9e5b620898f8ee4a95dd693ffecb25548c78
Manifest digest:sha256:e2c3576fb4fb4f64ff8d8fa492ae5d20f95d56fcd3b6543c79b214a4e36eeb54
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:192. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:e9da13fe274299602f4722bcc02eeba43a6527cb505cdfb5b07b072ef741a1f1 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:b757049fb30b2965512490b0f3b533d9d5e1c1700dce7cd4b63ac62ef282dff9 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:9117fd7540b941c4ca84269bf60562ec846a8df9c1d084348bcc9630954f41ea |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:661325d0b144cc602f6d5f184e952d91a82368e524e86a54160d71ad1cb0bb62 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:85d42db6f21f0fa4dbc91a9d6ae25f45755f7787fcf9020b8f0ecfad6c1fcfa8 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:33c3bfe6d89ed21bb3805654e9f16a25ee2d7d3ebb5d10cb476e7a86120e5dad |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:ae882069128acb7800eb025c0af5ccf71d839b9c9f79c02233d318ace4dee956 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:66132c15ae6c4622ffc9d45f6ed96584543e589ab3f3c7b8f47a996572a7d611 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:ba516a00703211a4bc5f604f36ad50904a7429df9c6bdc710364dfbc8307c443 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:422369c19011c3c194214dd833107621a41ba38df64acee0a0c6081d6ec5d908 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:f5c8c7b8734b8ba6fe0b27ebb2503d1d55c8b25219a2486da4e160b43d6435aa |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:a8467efc821ecc0366a3cc5c34136fce55925cb4a2616e60ace1143daf7ca58f |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:51db881cfb66fabfba53bd4e2a083e632cbb602d172111686a35f4a963cdde13 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:3aa606a47abbca38c64dbc96ef1e361f174c5aeaec72b6c60e61e9f8fa910d32 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:a8844989dae6946cb55ac33cac875785d535f2292eef04fce8e902adf081bf1d |