← All images

gitlab-runner Kubernetes, CI & IaC

Shell-less GitLab Runner CI/CD job executor, built from source via melange.

Size 160 MB Arch x86_64, aarch64 User nonroot (65532) Updated today Upstream docs.gitlab.com/runner/

Pull this image

docker pull ghcr.io/rtvkiz/minimal-gitlab-runner:latest

Details

Repository
ghcr.io/rtvkiz/minimal-gitlab-runner
Size (compressed)
160 MB
Built
2026-09-29T00:38:12Z (today)
Architectures
x86_64, aarch64
Primary package
gitlab-runner
Entrypoint
/usr/bin/gitlab-runner
Cmd
run --config /etc/gitlab-runner/config.toml
User
nonroot (65532)
Working dir
/home/nonroot
Architectures
x86_64, aarch64
Environment
PATH=/usr/bin:/binHOME=/home/nonroot
Labels
org.opencontainers.image.titleminimal-gitlab-runner
org.opencontainers.image.descriptionHardened shell-less GitLab Runner CI/CD job executor built from source via melange with daily CVE patches
org.opencontainers.image.urlhttps://github.com/rtvkiz/minimal
org.opencontainers.image.sourcehttps://github.com/rtvkiz/minimal/tree/main/images/gitlab-runner
org.opencontainers.image.licensesMIT
TagPullPublished
19 ghcr.io/rtvkiz/minimal-gitlab-runner:19 2026-09-29
19.4 ghcr.io/rtvkiz/minimal-gitlab-runner:19.4 2026-09-29
19.4.1-r0 ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.1-r0 2026-09-29
19.4.1-r0-20260929 ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.1-r0-20260929 2026-09-29
latest ghcr.io/rtvkiz/minimal-gitlab-runner:latest 2026-09-29
19-dev ghcr.io/rtvkiz/minimal-gitlab-runner:19-dev 2026-09-29
19.4-dev ghcr.io/rtvkiz/minimal-gitlab-runner:19.4-dev 2026-09-29
19.4.1-r0-20260929-dev ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.1-r0-20260929-dev 2026-09-29
19.4.1-r0-dev ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.1-r0-dev 2026-09-29
latest-dev ghcr.io/rtvkiz/minimal-gitlab-runner:latest-dev 2026-09-29
19.4.1-r0-20260928 ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.1-r0-20260928 2026-09-28
19.4.1-r0-20260928-dev ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.1-r0-20260928-dev 2026-09-28
19.4.1-r0-20260927 ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.1-r0-20260927 2026-09-27
19.4.1-r0-20260927-dev ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.1-r0-20260927-dev 2026-09-27
19.4.1-r0-20260926 ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.1-r0-20260926 2026-09-26
19.4.1-r0-20260926-dev ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.1-r0-20260926-dev 2026-09-26
19.4.1-r0-20260925 ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.1-r0-20260925 2026-09-25
19.4.1-r0-20260925-dev ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.1-r0-20260925-dev 2026-09-25
19.4.0-r0 ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.0-r0 2026-09-25
19.4.0-r0-20260925 ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.0-r0-20260925 2026-09-25
19.4.0-r0-20260925-dev ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.0-r0-20260925-dev 2026-09-25
19.4.0-r0-dev ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.0-r0-dev 2026-09-25
19.4.0-r0-20260924 ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.0-r0-20260924 2026-09-24
19.4.0-r0-20260924-dev ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.0-r0-20260924-dev 2026-09-24
19.4.0-r0-20260923 ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.0-r0-20260923 2026-09-23
19.4.0-r0-20260923-dev ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.0-r0-20260923-dev 2026-09-23
19.4.0-r0-20260922 ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.0-r0-20260922 2026-09-22
19.4.0-r0-20260922-dev ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.0-r0-20260922-dev 2026-09-22
19.4.0-r0-20260921 ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.0-r0-20260921 2026-09-21
19.4.0-r0-20260921-dev ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.0-r0-20260921-dev 2026-09-21
19.4.0-r0-20260920 ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.0-r0-20260920 2026-09-20
19.4.0-r0-20260920-dev ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.0-r0-20260920-dev 2026-09-20
19.4.0-r0-20260919 ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.0-r0-20260919 2026-09-19
19.4.0-r0-20260919-dev ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.0-r0-20260919-dev 2026-09-19
19.4.0-r0-20260918 ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.0-r0-20260918 2026-09-18
19.4.0-r0-20260918-dev ghcr.io/rtvkiz/minimal-gitlab-runner:19.4.0-r0-20260918-dev 2026-09-18

186 packages in the image, resolved from the SPDX SBOM.

PackageVersionLicense
alpine/ca-certificates20260909MPL-2.0 AND MIT
brotliv1.2.0MIT
brotli.yaml9db3aeed30b6359289528ef564a4909f78faeac9Apache-2.0
ca-certificates-bundle20260909-r1MPL-2.0 AND MIT
ca-certificates-bundle20260909-r1(MPL-2.0 AND MIT)
ca-certificates-bundle20260909-r1—
ca-certificates.yamlee3eac73dda22e8dd32fa5fb3e3a1712a6e812d7Apache-2.0
curlcurl-8_22_0MIT
curl.yamlc5048fcb3198115fb098c0a28f813517e4a1261bApache-2.0
cyrus-saslcyrus-sasl-2.1.28BSD-3-Clause
cyrus-sasl-heimdal-libs2.1.28-r57BSD-3-Clause
cyrus-sasl-heimdal-libs2.1.28-r57BSD-3-Clause
cyrus-sasl-heimdal-libs2.1.28-r57—
cyrus-sasl-heimdal.yamlee3eac73dda22e8dd32fa5fb3e3a1712a6e812d7Apache-2.0
e2fsprogsv1.47.4GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND MIT
e2fsprogs.yamlb99a75e3a9c26fa0720cd2cf394093c19d279152Apache-2.0
expat.yamldab6a75a661461bd0df375aac57d6c62655d076fApache-2.0
gcc.yaml794cf72f88e1b408eca5da0dbf5c5ed25543606dApache-2.0
gdbm1.26-r6GPL-3.0-or-later
gdbm1.26-r6GPL-3.0-or-later
gdbm1.26-r6—
gdbm.yamlf003022285365e5de3bee7aa44caafa602eca04bApache-2.0
git2.55.0-r8GPL-2.0-or-later AND ( Artistic-1.0-Perl OR GPL-1.0-or-later )
git2.55.0-r8GPL-2.0-or-later AND ( Artistic-1.0-Perl OR GPL-1.0-or-later )
git2.55.0-r8—
git.yamlee3eac73dda22e8dd32fa5fb3e3a1712a6e812d7Apache-2.0
git/gdbmv1.26GPL-3.0-or-later
git/glibcb4f51887c48ac82acfdb13f96d9eab5d120cb2b7LGPL-2.1-or-later
git/libunistringv1.4.2GPL-2.0-or-later OR LGPL-3.0-or-later
git/readlinereadline-8.3GPL-3.0-or-later
gitlab-runner19.4.1-r0MIT
glibc-2.442.44-r7LGPL-2.1-or-later
glibc-2.442.44-r7LGPL-2.1-or-later
glibc-2.442.44-r7—
glibc-2.44-locale-posix2.44-r7LGPL-2.1-or-later
glibc-2.44-locale-posix2.44-r7LGPL-2.1-or-later
glibc-2.44-locale-posix2.44-r7—
glibc-2.44.yaml2f4fbb70b55156f2d4cabff471b50dab0e75aa89Apache-2.0
gnutools/gccreleases/gcc-16.2.0GPL-3.0-or-later WITH GCC-exception-3.1
heimdalheimdal-7.8.0BSD-3-Clause
heimdal-libs7.8.0-r52BSD-3-Clause
heimdal-libs7.8.0-r52BSD-3-Clause
heimdal-libs7.8.0-r52—
heimdal.yaml16b770d73d6c8d3601394aa2d9f71d15b074a8dbApache-2.0
images/gitlab-runner/melange.yaml1bce6e63ea891bcced1fda6bdc6813ced3474c4e—
keyutils-libs1.6.3-r40GPL-2.0-or-later OR LGPL-2.0-or-later
keyutils-libs1.6.3-r40(GPL-2.0-or-later OR LGPL-2.0-or-later)
keyutils-libs1.6.3-r40—
keyutils.yaml2e53452a8c1a05c81d7beb0148e1b8d73fd088c3Apache-2.0
krb5krb5-1.22.2-finalMIT
krb5-conf1.0-r9MIT
krb5-conf1.0-r9MIT
krb5-conf1.0-r9—
krb5-conf.yamlbb37bc90f076f9eb2a12980e43c3f12673133835Apache-2.0
krb5-libs1.22.2-r4MIT
krb5-libs1.22.2-r4MIT
krb5-libs1.22.2-r4—
krb5.yaml9a7875e9cfcbd59186154753bceb1d973e939c32Apache-2.0
ld-linux-2.442.44-r7LGPL-2.1-or-later
ld-linux-2.442.44-r7LGPL-2.1-or-later
ld-linux-2.442.44-r7—
libbrotlicommon11.2.0-r5MIT
libbrotlicommon11.2.0-r5MIT
libbrotlicommon11.2.0-r5—
libbrotlidec11.2.0-r5MIT
libbrotlidec11.2.0-r5MIT
libbrotlidec11.2.0-r5—
libbrotlienc11.2.0-r5MIT
libbrotlienc11.2.0-r5MIT
libbrotlienc11.2.0-r5—
libcom_err1.47.4-r2GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND MIT
libcom_err1.47.4-r2(GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND MIT)
libcom_err1.47.4-r2—
libcrypt1-2.442.44-r7LGPL-2.1-or-later
libcrypt1-2.442.44-r7LGPL-2.1-or-later
libcrypt1-2.442.44-r7—
libcrypto33.6.4-r8Apache-2.0
libcrypto33.6.4-r8Apache-2.0
libcrypto33.6.4-r8—
libcurl-openssl48.22.0-r3MIT
libcurl-openssl48.22.0-r3MIT
libcurl-openssl48.22.0-r3—
libexpatR_2_8_5MIT
libexpat12.8.5-r0MIT
libexpat12.8.5-r0MIT
libexpat12.8.5-r0—
libgcc16.2.0-r1GPL-3.0-or-later WITH GCC-exception-3.1
libgcc16.2.0-r1(GPL-3.0-or-later WITH GCC-exception-3.1)
libgcc16.2.0-r1—
libidn/libidn2v2.3.8GPL-2.0-or-later AND LGPL-3.0-or-later
libidn22.3.8-r9GPL-2.0-or-later AND LGPL-3.0-or-later
libidn22.3.8-r9(GPL-2.0-or-later AND LGPL-3.0-or-later)
libidn22.3.8-r9—
libidn2.yaml515b608d6ada311d2f8d873090ee6e9ab1b0e270Apache-2.0
libldap-2.72.7.1-r1OLDAP-2.8
libldap-2.72.7.1-r1OLDAP-2.8
libldap-2.72.7.1-r1—
libnghttp2-141.70.0-r4MIT
libnghttp2-141.70.0-r4MIT
libnghttp2-141.70.0-r4—
libpcre2-8-010.49-r0BSD-3-Clause
libpcre2-8-010.49-r0BSD-3-Clause
libpcre2-8-010.49-r0—
libpsl0.23.3-r1MIT
libpsl0.23.3MIT
libpsl0.23.3-r1MIT
libpsl0.23.3-r1—
libpsl.yamlf5315bacaee7e38f785cf4506595b8a03d29e5c0Apache-2.0
libssl33.6.4-r8Apache-2.0
libssl33.6.4-r8Apache-2.0
libssl33.6.4-r8—
libunistring1.4.2-r3GPL-2.0-or-later OR LGPL-3.0-or-later
libunistring1.4.2-r3(GPL-2.0-or-later OR LGPL-3.0-or-later)
libunistring1.4.2-r3—
libunistring.yaml7ef46f8f31c30c8b2ad450cc071debf618da28f5Apache-2.0
libverto0.3.2-r8MIT
libverto0.3.2MIT
libverto0.3.2-r8MIT
libverto0.3.2-r8—
libverto.yaml12f50f8d25640a0ca5ce3ac4cb6a2b8c472ab7a6Apache-2.0
libxcrypt4.5.2-r5GPL-2.0-or-later AND LGPL-2.1-or-later
libxcryptv4.5.2GPL-2.0-or-later AND LGPL-2.1-or-later
libxcrypt4.5.2-r5(GPL-2.0-or-later AND LGPL-2.1-or-later)
libxcrypt4.5.2-r5—
libxcrypt.yamle199a2ea58e2f64dce226ac5edb148fa8ff72664Apache-2.0
ncurses6.6.20260926-r0MIT
ncurses6.6.20260926-r0MIT
ncurses6.6.20260926-r0—
ncurses-snapshotsv6_6_20260926MIT
ncurses-terminfo-base6.6.20260926-r0MIT
ncurses-terminfo-base6.6.20260926-r0MIT
ncurses-terminfo-base6.6.20260926-r0—
ncurses.yaml49af4fd909fca8f288f9ca88f700cbb6bd987f33Apache-2.0
nghttp2v1.70.0MIT
nghttp2.yaml88d034c8a90ab9303114c4a82765cd63372ec5f3Apache-2.0
nghttp31.18.0-r1MIT
nghttp3v1.18.0MIT
nghttp31.18.0-r1MIT
nghttp31.18.0-r1—
nghttp3.yaml0956f7ab8259acb3cad0885e4537ed6b1779d818Apache-2.0
ngtcp21.25.0-r4MIT
ngtcp2v1.25.0MIT
ngtcp21.25.0-r4MIT
ngtcp21.25.0-r4—
ngtcp2.yamlecc58ee4fc1a3a0734bbd164bc518a4ac0ed371cApache-2.0
openldapOPENLDAP_REL_ENG_2_7_1OLDAP-2.8
openldap-2.7.yaml0bec60b2e47ce757adc2340f526da8e90046e0b8Apache-2.0
opensslopenssl-4.0.2Apache-2.0
opensslopenssl-3.6.4Apache-2.0
openssl-4.0-libcrypto4.0.2-r2Apache-2.0
openssl-4.0-libcrypto4.0.2-r2Apache-2.0
openssl-4.0-libcrypto4.0.2-r2—
openssl-4.0-libssl4.0.2-r2Apache-2.0
openssl-4.0-libssl4.0.2-r2Apache-2.0
openssl-4.0-libssl4.0.2-r2—
openssl-4.0.yamlb8f04118437fbbf25bbaad575ccb9f2ed62b8503Apache-2.0
openssl-provider-legacy-allowed4.0.2-r3Apache-2.0
openssl-provider-legacy-allowed4.0.2-r3Apache-2.0
openssl-provider-legacy-allowed4.0.2-r3—
openssl-provider-legacy-allowed.yamlb8f04118437fbbf25bbaad575ccb9f2ed62b8503Apache-2.0
openssl.yamlbe56cfaac075e77bffb92439e0438bb31a21a2c7Apache-2.0
pcre2pcre2-10.49BSD-3-Clause
pcre2.yaml12446114fe264503593128d308520875edaca797Apache-2.0
pub/scm/git/gitv2.55.0GPL-2.0-or-later AND ( Artistic-1.0-Perl OR GPL-1.0-or-later )
pub/scm/linux/kernel/git/dhowells/keyutilsv1.6.3GPL-2.0-or-later OR LGPL-2.0-or-later
readline8.3-r3GPL-3.0-or-later
readline8.3-r3GPL-3.0-or-later
readline8.3-r3—
readline.yaml20a5359ac0a7a6aca23efa343f0f29c8d3ea1453Apache-2.0
sha256:1b44242c166a4d5e67179b25d9abc2d5a0b11fa8a0bc7ecc2d3870f0ed9607b720230201—
sha256:4046199ef30be288293c4534e730421a9a003ed6099cebe7439beee0366f57dbsha256:4046199ef30be288293c4534e730421a9a003ed6099cebe7439beee0366f57db—
sqlite3.53.4—
sqlite-libs3.53.4-r2blessing
sqlite-libs3.53.4-r2blessing
sqlite-libs3.53.4-r2—
sqlite.yaml89df0d1a31c1a22d7d67ddf690145ffc5b9f759dApache-2.0
wolfi20230201—
wolfi-baselayout20230201-r30MIT
wolfi-baselayout20230201-r30MIT
wolfi-baselayout20230201-r30—
wolfi-baselayout.yamla4472f6292a5e48d6d611bf24c6e119b1a483e66Apache-2.0
zlib1.3.2.1_rc20260601-r0MPL-2.0 AND MIT
zlibe3dc0a85b7032e98380dec011bc8f2c2ee0d8fcaMPL-2.0 AND MIT
zlib1.3.2.1_rc20260601-r0(MPL-2.0 AND MIT)
zlib1.3.2.1_rc20260601-r0—
zlib.yamlf2ad881d0053f3f3b6b639e041b171fc0e5b7244Apache-2.0
4 medium 0 fixable
CVESeverityPackageInstalledFixed in
CVE-2026-77117 Medium glibc-2.44 2.44-r7 —
CVE-2026-80489 Medium glibc-2.44 2.44-r7 —
CVE-2026-8674 Medium glibc-2.44 2.44-r7 —
CVE-2026-89092 Medium glibc-2.44 2.44-r7 —
GO-2026-5932 Unknown golang.org/x/crypto v0.57.0 —

Everything is verifiable without an account. Copy and run:

Build provenance (SLSA v1.0, Build L2)

gh attestation verify oci://ghcr.io/rtvkiz/minimal-gitlab-runner:latest --owner rtvkiz

Cosign signature

cosign verify \
  --certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/rtvkiz/minimal-gitlab-runner:latest

SBOM attestation (SPDX)

cosign verify-attestation --type spdxjson \
  --certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/rtvkiz/minimal-gitlab-runner:latest \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Signatures are logged in the public Rekor transparency log.

More Kubernetes, CI & IaC images

Weighing this against another provider? The comparison pages publish head-to-head scan data with the raw dataset, including the images where Minimal comes off worse — or read the migration guide for what actually breaks when you switch.