dhi.io/gitlab-runner
GitLab Runner 19.x (fips)
19-debian-fips, 19-debian13-fips, 19-fips, 19.5-debian-fips, 19.5-debian13-fips, 19.5-fips, 19.5.2-debian-fips, 19.5.2-debian13-fips, 19.5.2-fips
sha256:90b20628a284fa4a50c3dea80f22d2fc0a7323c470613727341bb1fdf4d66354
Manifest digest:sha256:6e60ea6e4d69cf2c9c69b0e1f3d39e54fb91774594675156192f8d4de5fd9fea
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:964f703c4c6eaef0bf97eaeac34fd8ca0d771ed445052c75b48a204ae00758d9 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:f72c63216194762a927bbd67dc2766d0d4d6e3fe596eaa61585984b653c00220 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/gitlab-runner@sha256:3dcf9c1408a179b6faab51b50c60fe6fac6c661d22fb1b905de743de7c826e18 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:b1c71c0c25b313bc06f9084e7a22654244acae13e5071259ad7bc2b3c50ebfea |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/gitlab-runner@sha256:06d899be9977dd064f8a59c3e19d0a947ac66bdec702a4ae403818c723ceafa0 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:d47c7e56651ab237d362509ff79c712dfd1f0df0bc385323a3b418d190765385 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:a5b34773b42cc5f5676d5b07a5119640458a4391dff2148c7a899983b8b744cd |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:4b2cc2eeda99dc1ee8007fb401dc3563281c067e9be66ef6bb448447b93194bb |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:27e8c469d32fbc07069403ac7d6ae8ed82b28a22872ed4b26a9b4fc5586695de |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:b7253ace2a7c4cc88e87911104ccadafb5a543cda21e8a3f36743b9c8abe5b7a |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:47c0ad6d6b6ad86cf5d0eb1d6a2d2a3845a78275f558b206b05a9bff2e7cbd72 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:aa20ab3dde431997d7def0e4c1fac2c843e9db47e04c2482632faecd8c8a4390 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:2ee1ba51b4e7daefba8e06c5a391e6403d177d5baef7cf05c94a48eca1a8026c |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:5041d1653492d2b25fee6cb7b1406b7df8e9b1b69cb505cbfc4a0ea244891841 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:361cf85acc8f6e7c2e60939e2ada4990ca85dcaec5055d126afdc41dbf4d3291 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:e56f12776c72907502646907010d39ae06ff4611d45450bfb1b9cfda649fd8ee |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:4ba6f2c746c2272a5e08db28fe83613307c720d183e2ea21806e4c3d2ed544b0 |