dhi.io/gitlab-runner
GitLab Runner 19.x (dev)
19-debian-dev, 19-debian13-dev, 19-dev, 19.5-debian-dev, 19.5-debian13-dev, 19.5-dev, 19.5.0-debian-dev, 19.5.0-debian13-dev, 19.5.0-dev
sha256:4a830b658ba27aabc6c9812218d64e4605ca032c21fa6f0dfb276c8a547d2b41
Manifest digest:sha256:139891b52f647716672106d1fba34cf664cef84108f1826eee1b5b7113d5ed3c
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:19-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:19-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:e756e2be6522b381e0bd7d5a5c3fa391616fc49bc12602276429706c7f7c25e6 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:010a35cdc16a0954f9d072ad2dbe90c36a70d0effbc72bb873bfe4dccc54ec9c |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:e2253b5f17e1fe955770a0d57261e0f6b410a2c48e855ac315ef4a266c7db01d |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:c55f9550ef8be410276b458c85187a0315e4337d6ac45f8d5085c0cb87a8fd42 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:cdedde47a608d5a177d00bba7709d1bb813b418562aceffbb1b2ff6aa4f522fe |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:a3a6069334deaadc9cc8bd8b36aff60473eec14f8d9a43678f326a1658fc883e |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:89a3935dfe923230c975db76da083b64f9f71f8b5220d18eb379e161bf29ed26 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:3041cc102de9ec6982528b3692472a4700dd82bc5e43b4ff8c9bb1e4623ec581 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:8a4e2c7fbf483fb5b0dca0e033354ea7d3521a8b61d795ea258fab213afb127f |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:409dd64bbdf6d3772c4545680e26e2fe0de34bf2b0341cfb5baa50728c813f3a |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:0604ee856f3a1bc42c9496e5fa54bf0469785cb5f2551e82c59412033bd3fdd9 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:840ff55901ac745ede686ea00b96c51bc0f12855fa8fa76c628e28d46d58812b |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:aaae91ed2cb4b5d133b74401f627de39e9399b5261e34653cff5a9d2c5ed727a |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:d9e9350a4f5b68a3650b3e77ac2daf4b1df2740ed1208a37aab5c936a07b02c9 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:bad5769d1f63f718cd0c6eb3accb1c2ab22cc5632c9a030dbe6e07e6504eaad9 |