dhi.io/gitlab-runner
GitLab Runner 18.x (fips, dev)
18-debian-fips-dev, 18-debian13-fips-dev, 18-fips-dev, 18.11-debian-fips-dev, 18.11-debian13-fips-dev, 18.11-fips-dev, 18.11.4-debian-fips-dev, 18.11.4-debian13-fips-dev, 18.11.4-fips-dev
sha256:ae6b9343eda1a9eef3bc5675b751c9be95ad914333b2b67c5df0af9552a23aba
Manifest digest:sha256:5dfbb3463f192dabf9f025283313befbabaaaf3afa5a468ef86e83fcec9b3800
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:18-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:30a29927a55a84b578f3951df383984606525a2748b27182cb2ba18bdf9e75ab |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:01a3338d1fab3e797c9c71d5c455379682c32c9744085d22aa2b936bf99377c8 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:8b5c1188ee3120984e381122cb21630cf1d6f98d43fb3e26b64d846e10c28609 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:2060aa772939b603e5eb2216bab5fc56cc0d7ad05bb1d9676055f08db7c28a2c |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:da142a1de4b539d6739e9fb979ecf907718f994d0271c4ad47d2215e5a0ac358 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:bb3fcbe03de2eb5964b4fa081002abaa5e8d414fdb7df12df9c5c580275669ff |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:38622a79f1cc07e1bd018bf3585ff60a837e77b4f54388c09ea8961a5eacb778 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:40177d7c67bed43b508db2193f3c7c6f921cb905ba2d1c27447b1a7d3fe101bf |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:70a995d307331ee7a977a74c9ce4b1edce6c647fde96d9d0fdb1f37a25c1fc42 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:8f29299d82e584b1fbbf20d3b12437e90af3884f959722a853d2c83b87a5f97b |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:f3578a0d7dbd57af7ac629aad0e7b71d640731c3d6259c0aff1cd599af17434e |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:1d97914d6ff0a959fcf30707b5b14e1cda7e216e02f541b0b1e102fdb74a5a58 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:d664cf4c02d0024826a2928081653d32642b52966edbfd6472c4ebc3b563f93c |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:7ee972f8616919b6d1200d3a599259a58928b090795eab31e501c75e468484fc |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:1f2c2d4a1f4a6de91e28c5cee7754c33991cecb29e51fe5640a4668e2a178e88 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:b015168a5c308e789159caf39b6666184afb6245359009000b857dacdbac8c6c |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:01f15cdcd10f5ff27add9781211727780491ba6c0ae706e054e475a4faa06689 |