dhi.io/gitlab-runner
GitLab Runner 19.x (dev)
19-debian-dev, 19-debian13-dev, 19-dev, 19.5-debian-dev, 19.5-debian13-dev, 19.5-dev, 19.5.2-debian-dev, 19.5.2-debian13-dev, 19.5.2-dev
sha256:86b57f4eebb8c4ac4b4e5f82910cd1a1f290d6adc511476fee25668c1a8d6f8a
Manifest digest:sha256:57de10764b62a866d6c08b657585200a9c7ddbb83b2a12281045e25389363389
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:24fac9f51c78bdfdece5a618c65b481cfd7e00db5db03ead839b6fba31957285 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:d7355cb0b5e04a32f89e91dd140f55855c6836dd72da3145c727c0bd3aa96df3 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:046689a5c1c3494d52e876cbc42944bd51037a015319cea67e1d1c995d01fe5b |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:5c44409526d2a9bfcbdd3e091a78107189e6b9ca59af8761e1106068ffbbd7dc |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:17f448dddf70cf036750541ba05a4adc59bdcf75303f3ff0da1cbf8508966943 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:fb820eed81765debe4c1f37b8326b3274b0f7fa6e90fcf4cb84ec96e7bb8eb26 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:3cf03ab33a836452ea425bee1d5d514985aa76c95765c89f3e272afa63c35c60 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:6af60bef9aea3a0bf8f2af93a7a801b76dc8deecf102705167609f7d9f62bcef |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:1ac78703c0e6743dc42291cfbe133fc36cac8d7bf4f15b2c7f9193ace8caa239 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:d2c212a45fe1429ad2f81df2c4f2f2edbf77aca8b229eb90d7689ca64b5d0ecd |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:68bf6abb511347ba12c22741d6239956b331c98e0466db5d08d49b9c73c01de6 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:7770ebfb689a5ac8ac17da82c00a9c9a23cc1b0b7938ef944e10d4694ab99a43 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:af3180b337e046324a64d50e1d0266685c945e2351b82ff968946c2fbb918149 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:f79a4a0c1f0bce065dda112f47bbccf644a0a77eceb6aa833201bcd66b895ef1 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:3c48bd48290bc81f4276501ee6a4c8a6ef06c6fb117923a0c8bb4213ef3a3ff9 |