dhi.io/gitlab-runner
GitLab Runner 18.x (dev)
18-debian-dev, 18-debian13-dev, 18-dev, 18.11-debian-dev, 18.11-debian13-dev, 18.11-dev, 18.11.4-debian-dev, 18.11.4-debian13-dev, 18.11.4-dev
sha256:fb9dc65df67a5ad6c00e93c09e09582cb84f75d7bb23e354ba666ffbf21f854b
Manifest digest:sha256:4ece20d5f446f11f287dde51a0ebcce242a0fe1e063909625f1aa2ff4f722014
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:18-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:26b0b75fd0cf3584f1d079b73346edb16d4871335d63aa037ba47775e4a9648c |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:4ebaeee256babb74acd88b6ea08b07a2e13cf305fbeb71cae420c8fa46c2e07b |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:3286bbf1460a92077622a11f1ad2eaf09a47439b2fff6ca79f0bd8421754bfee |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:f8a7b9372eebf40b42add95ca2d0f131d6e19102b28254083f7a0d01a9b6170f |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:90fcbae1ab5e15b18813e07f02e7d82764a5e75a7e072bdc71b21f300b8ecf9b |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:594a2627b084a0acdf723f8af1adbbdf181198ab1383539f1121a19fc4452d48 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:ba24566be366953a5815575f24b97d03c72f3bf22e874a8716005939c4103780 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:3e15c17f4a9d2d6c82804f9c1f44e2f9280e79d0bbd1990221d4265ca5997c9d |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:e88c017108fc5dc130cf084522bfdbb03768e4092242794eafa30671eccd07fb |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:879e853c27ef8bff2028def9c94fbe08d120249167f5c4d444ee9c8ee62b736b |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:b3c6468d94bb6879ac3646b564f2076680616e624282233bfb84d0749df26072 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:da4d6d8b75bd05b916e84e185402713013b0b3c5899fcb37110cf93c22fcba93 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:ad5dd00232bc2026e8ac17c5586af4869a46f3c2043a5e8c4d9f735c8e120206 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:d2e2db32800d9e68312f10fbf0ed3f5914027b2be87b4437485b9fb918d09047 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:3b53441988f1db4ed985c8bd40e4080c808ee43fc7b680ea2e92f8703c569fa1 |