dhi.io/gitlab-runner
GitLab Runner 19.x
19, 19-debian, 19-debian13, 19.5, 19.5-debian, 19.5-debian13, 19.5.2, 19.5.2-debian, 19.5.2-debian13
sha256:d12ee68f7df71b9a2b79cbc5cf869c89ef15f6514e20ca07360fa863ef26dfd5
Manifest digest:sha256:49516fa753ae09ca4edd72feb78153b6cbe85f1990f6ccc69701787b20af0239
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:192. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:9788533ee4c38767dad5fd3b2b3b6752074aa9bbe151c5a8c81ab20b373bbb1a |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:9c6f69d537254c06e570608f6fed2deccd6b12b7f8348af504a5106e0c8f8af9 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:38b996465d03fc899e0d6fa907f897df5f168a1f59611eb2c24fe90406af118c |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:973fe85439f395a4b9c5a3c80526698275d3830a613a1b6e72a4e7ddf215fc99 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:8301213a6f77a8bf9e973e40083d7deeb3d41791235cf34751ba87124b600dcc |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:a6c67d2eec38b1aab498683d5f0c10393b33f06aeb88bdf2b5bff74de136db84 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:cc1226772d09a48be3799fbb20fb756cb54aae2344b4d8772885a6278b1ce3bc |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:0c7572f39d7d409fd38ccc5061eec7ec1d302a0fce8f90d51740f921a2fd6178 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:8335e284d1c691fa2400b55f65d9bbd651cff69541df2052e62a8c202dfcc900 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:905afe830f65cdf9467677f7197e1ba8553b56e7dffc3f59b3b0a8f8d2538c37 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:b6f60a7087d1c418802374131d63b1154dc3993f8177b90fc873e3fb244db68e |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:8ef2540da78fd3d6cb354e24ad032b16f864023f0d8d45a5d0c8459af7632937 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:7a147e2bc65e0b3399a77dde006fa725aa498b29055fcde14a971bba7ee0e4bc |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:dec3be10357b0b23712a057a4285901d6181b193e8a79771e71fef33e9adf76f |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:576fb522196f7d59b5199131bb65b0b69d796f6b23fd29a1aeafbef7fca9e373 |