dhi.io/gitlab-runner
GitLab Runner 18.x (dev)
18-debian-dev, 18-debian13-dev, 18-dev, 18.11-debian-dev, 18.11-debian13-dev, 18.11-dev, 18.11.4-debian-dev, 18.11.4-debian13-dev, 18.11.4-dev
sha256:16076834463d1cc53667d9826d24fe2f95fa12745a057d06908f861db06476b9
Manifest digest:sha256:635715a0f836aa259d2d12026b75cad4385844ef7bb0c399396813d8ec7ff0a0
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner:18-debian-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner:18-debian-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner@sha256:68e632117946c3ecdc66ee017cb01f9eb07903d5951834ddf5b56013ec859211 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner@sha256:6ee26c11450baa45897093d4091f67a5cc048861263e9f6d4791bb0f09426310 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner@sha256:534b8278a9eba287c6acba485a66ee0225e4f33c3be5d4d685b1efedd40e37fd |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner@sha256:991e26ad9cbe9f537724256183deaa73d650b1e511d15283ec6da4bd01478af4 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner@sha256:3c00124a2b100b24eb016e44dd0d1bd0824895f6b6433e68a4264d30bd81fcf0 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner@sha256:de92377ae42ccdf4622a2836407d61b4775fca3d717c4baff776cde21b71d941 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner@sha256:addba57d8222215e7f4236ef8e76b7b08d1c8a861917a5138da1a97cdde62ec9 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner@sha256:c4d4d3ff752561a39752c0d98ec113b340d27c034b32351c5c62d1191ca503c9 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner@sha256:aca7fc8a1fb6cbf7639e99677d297c460d4fe5e2040f8b7b952fd3be86cd9457 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner@sha256:ebf90accd8e4d5973bdd5620b29dd94029ec513c5d12e83d1d7807432fe12f77 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner@sha256:5802b14058b8f32bcf668c3b4c55539c680390504361c487f3a3b1a0684bf9a6 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner@sha256:42d777a6e612cfa9f0173ebaa386dd310bdd85b6194be55cc16143e97c669372 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner@sha256:45cfa810aadc59746f5db990f3ed14b42487fd3fe70621438cfa9604239c3b2e |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner@sha256:8abf70747af6a8a1cfd2592a35c02c38da8b0275471e905bb829a51bec5eb36d |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner@sha256:6c67cd18a1af7e1ed2f44d5c1ff5c24658bf22d6b431549bc769d40b091959a2 |