dhi.io/gitlab-runner
GitLab Runner 18.x (fips)
18-debian-fips, 18-debian13-fips, 18-fips, 18.11-debian-fips, 18.11-debian13-fips, 18.11-fips, 18.11.4-debian-fips, 18.11.4-debian13-fips, 18.11.4-fips
sha256:7b8491ecff7431b2ea17de6b5e54cf67571cb10b1a728c466a8c1337a6515882
Manifest digest:sha256:a20f27475b77390e35db142fee54ee35febe1d6ee5db98fe11ff027ca944951a
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:18-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:0959cb21c3d1dc13f81276b4f3afba29b70fa7383d8a5fa1dca6cf032585ade1 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:2f61202221df415f6c3048458acafd99d4acfbff6b6428e1a985bc15d89b082b |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:92a65d014d2d90107993963cad3226bc11cba58cda9422fe4ce49204451f3b2d |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:06fbb50044a2d35be0a6aca8293215c62851633c0d9419b9e584ca9a812ee57d |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:05a928d760543a0998c892c40e1dd8baba542e3925da9d7f2748525e4560ae91 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:02aa9ba02a1a094a76b9c20ec92cc2139f5e959dd0ee9ec4ef4d8598f292a721 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:d90c82037dd18d547897d01fba64272fc427b618acc10ee8399db5e5997ca60f |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:dae367ad519248d49d50e611e485bd4ef54ed976f59730a979b384e1ccb1c30e |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:ac42a6e5f7424cbb0c4472427cf73ee56890469fb291a93f758cd0dc7f809ace |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:f46d9824a1ff3c1a8aa3f6c0afd9e0e9aeb458f2871d466a24081581b42221b3 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:272001992dd12faf8643f0d8fc2ee7b4371de0280627e1c4d886733682969b7a |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:b7c9f22e13ede93010c89abb56d96004d280a20b69a64cdaf80241417c2d9d6c |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:96545a357bade70c02584f17297e89ff063d2ea8cd303c3c442acd3bad64eaf2 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:98b84a569d2772fb1e90ea9f53613d36350a3bbbc44ca7e4ab118d361a4be655 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:3917368c0ff68bf485c81cd9f7f6fab7845a908debe3f5bad76300c1939f492e |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:bb85d19fd468a2f0f5a1adffa069772f89c06dca7518a0782dc8b5f0c80ed6f1 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:739cbd67ba28429f04e2bd69d8c15928f74d7f7479934a78130e4345e292c2e1 |