dhi.io/gitlab-runner
GitLab Runner 18.x (dev)
18-debian-dev, 18-debian13-dev, 18-dev, 18.11-debian-dev, 18.11-debian13-dev, 18.11-dev, 18.11.4-debian-dev, 18.11.4-debian13-dev, 18.11.4-dev
sha256:3e22a6b8ae9c3f1fea270deb5c99f245d98ba8acaf73e864da4965daed299cd7
Manifest digest:sha256:278330a612e182d394c5499ea063ca3b86f7bf1dd0317201b0a0cf168b371ec2
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:18-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:5c171d4962db9bfab746db46e0057f0449b13e7daf9fa55d58cf44ebb687ff2b |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:cdf4f880c67891cfa3d619587bd88ad91d4d988d607ed97c1267d8a91002f5bb |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:5cdb2dfe1312d20480d3f7aac0015b619d90f24d5b0fc59d269f9d3aa026ad5a |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:774fa5b9cf1b277cc1332139ea1bca450ec0b384aaecdb0439ed6784a049c4e2 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:8218be5de9fcc03fcafa6263741038ac5174f9f884c421462a66651228be5539 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:089bb14cddb7db3e25fa69f712d561540ed4e6b3857eb316ff8254d841080c01 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:3bf7c1e10bb1875908c7930c923bce0b0dd9085e984123edb9a2f4dde2c5b566 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:6e0c0754a749bef1b6cd520ec1ff3370891accd7fcedc277fe3d1ac892398521 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:107fee58f5a2a87d5120566bbb9c24a2ab940adcc3a2c8a4059b819d1ad0cfa6 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:df46c10085a92944d0a10ae196a8aac7ad271dbae2fe5a456a6431f6349ab91b |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:01dbfc3fa081c81bb156ec3c512b33d4e55adb98e1c3886232cbf774bae5bb09 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:be16c6728f1037febcaa43d42a7585f3fdeb8c1b88c579934906ff675aadb69f |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:478392b181e38d57b0de608915b43b461f7230236eb720e33ea7d636605304a6 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:137bb2082726df7724d46bd2519a49f351e2376cc4f7c6e6ba661ca3cd0009e0 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:b448f4cebf94e90153f2719b8bc61e7146de6f677cc36fde866edf008f0f017a |