dhi.io/gitlab-runner
GitLab Runner 18.x (fips, dev)
18-debian-fips-dev, 18-debian13-fips-dev, 18-fips-dev, 18.11-debian-fips-dev, 18.11-debian13-fips-dev, 18.11-fips-dev, 18.11.4-debian-fips-dev, 18.11.4-debian13-fips-dev, 18.11.4-fips-dev
sha256:8f785af711669389aec6f545d69a1e32f302cba578a83b56eeb072797e5b26bb
Manifest digest:sha256:3ff3a673def3b9da83d40122405c5b3331cb0fc108485d659924562824fae4e8
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:18-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:13c38d742f611dd432c3cc9a600af240afd5179b561dc6e5775021a122dfa61f |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:b79c8748a89a595566f796d7a6fd65693013f5a117d63610730beb1494f94dfc |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:874a681f5f681a5749a2e9867a0947eb9d1822fd0f8096eae3e49faf6073aa3a |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:3cee390b044dd1c6e283f63d26c7bc04b60d059ffe991c2a6d7580eaab43b526 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:7b75ae907d521be5d173090bb453c8b2d4bc6b6383e9adf90db99878e50c530f |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:39bb3353d8f7e1b4f6f7a8b4d8b0721dd1c8a374b51ac3bf3b30993a68e91d33 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:f6c0ad10a1d22bdc52e6f5b0d430eacb2f891a1c256cfe01d8d7f5dd9236a1fc |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:c96be94ea1d4f597c51ed5778ed9e4e0d6a94c2b2a924b3def18c59a27ca485f |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:788522f3cea7f8292615c32f936ce74cd44a47e70b381fd45b3a127db10de47a |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:961454bfe8ece0cbd55d78531e57e4c8a923ee2b21781ecce21f100921e1c1a5 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:e5ae804c890ea763a1e2bccb6b64d6ba900d06c327642108e1570c90a9e06a65 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:9595f3490c08e2636f9e2e1089f5067ffb992763e13e6849894b54007460c0ee |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:f7af86cbf2fc6add9e64e8b7d9fb3fb02197f712dad3b7de5469453862ef05fa |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:af4ce027aca3a899e9fea4b36585b73867048295c6f550a44d076f6abf4d0c8f |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:7b14219086f596826bd20f0166b0ec81b8913220ba87a0669d6c55ac842eca01 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:8c1435f65646d8418f7d15227bc59dd90f1346b1c4a58b5eff68f5d7e15fa91c |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:615bbc3f8685bc5c379f463a7a86e7b96e11f173a27c7704a347e36e5eed1dd3 |