[{"data":1,"prerenderedAt":1893},["ShallowReactive",2],{"/blog/secure-open-source-container-infrastructure-with-gitlab-and-chainguard":3,"navigation-en-us":1109,"banner-en-us":1535,"footer-en-us":1545,"blog-post-authors-en-us-Fernando Diaz":1790,"blog-related-posts-en-us-secure-open-source-container-infrastructure-with-gitlab-and-chainguard":1805,"blog-promotions-en-us":1830,"next-steps-en-us":1883},{"id":4,"title":5,"authors":6,"body":8,"category":1092,"date":1093,"description":1094,"extension":1095,"externalUrl":1096,"faq":1096,"featured":1097,"heroImage":1098,"meta":1099,"navigation":254,"path":1100,"seo":1101,"slug":1105,"stem":1106,"tags":1096,"template":1107,"updatedDate":1096,"__hash__":1108},"blogPosts/en-us/blog/secure-open-source-container-infrastructure-with-gitlab-and-chainguard.md","Secure open source container infrastructure with GitLab and Chainguard",[7],"Fernando Diaz",{"type":9,"value":10,"toc":1077},"minimark",[11,15,18,21,50,53,58,61,106,109,113,128,135,141,144,173,177,180,188,193,217,343,347,350,405,421,515,522,528,533,545,549,552,572,586,592,596,599,604,607,611,614,631,634,751,766,806,814,820,825,828,848,854,858,861,869,874,878,887,907,910,916,920,924,927,935,941,945,948,954,958,961,975,979,982,997,1003,1007,1022,1026,1029,1073],[12,13,14],"p",{},"Container technology, which creates consistent environments and streamlines deployment processes, is incredibly beneficial for software development.\nContainers contribute to faster development cycles, more efficient resource utilization, and greater flexibility in application management.",[12,16,17],{},"Some of that efficiency can be lost, though, if organizations reinvent the wheel with each software development project. Instead, a base image should serve as the starting point for building other container images. These base images contain a bare minimum OS, essential tools, ensured compatibility, reduced image size, and other advantages.",[12,19,20],{},"While base images provide a lot of value, they do have risks. It’s easy for your application to be compromised due to:",[22,23,24,32,38,44],"ul",{},[25,26,27,31],"li",{},[28,29,30],"strong",{},"Large attack surface:"," Base images may include extraneous packages,\nwhich could increase the attack surface.",[25,33,34,37],{},[28,35,36],{},"Unmanaged dependencies:"," Many dependencies in container images are not\nfrequently updated and can be filled with vulnerabilities.",[25,39,40,43],{},[28,41,42],{},"Severe and unknown vulnerabilities:"," There's a high risk of severe and\nunknown vulnerabilities present in a base image, even in known public registries.",[25,45,46,49],{},[28,47,48],{},"Misconfiguration:"," Base images may be misconfigured or contain a\nstandard configuration that contains hard-coded secrets and can lead to unauthorized access.",[12,51,52],{},"GitLab and Chainguard provide several solutions to address these risks, including Hardened Base Images, Container Signing, and Vulnerability\nScanning and Management. In this article, you'll learn how these features can be implemented to prevent breaches via containerized applications.",[54,55,57],"h2",{"id":56},"chainguards-minimal-hardened-container-images-with-low-to-no-cves","Chainguard’s minimal, hardened container images with low-to-no CVEs",[12,59,60],{},"Chainguard Images offer several key benefits that make them essential for organizations prioritizing security:",[22,62,63,69,75,94,100],{},[25,64,65,68],{},[28,66,67],{},"Low-to-no vulnerabilities (out of the box and Day Two):"," Chainguard\nimages are the product of a Linux distro and toolchain purposely built from the ground up to distribute patched open source software fast.",[25,70,71,74],{},[28,72,73],{},"Reduced attack surface:"," Hardened images remove unnecessary components,\nlibraries, and tools, significantly reducing potential entry points for attackers. This minimization of the attack surface makes it more difficult for malicious actors to exploit vulnerabilities.",[25,76,77,80,81,87,88,93],{},[28,78,79],{},"Improved compliance:"," Many industries have strict security regulations.\nHardened images, especially those designed to meet ",[82,83,86],"a",{"href":84,"rel":85},"https://www.nist.gov/standardsgov/compliance-faqs-federal-information-processing-standards-fips",[],"FIPS hardening standards","\nand to include a security technical implementation guide, or STIG, help organizations meet compliance requirements like ",[82,89,92],{"href":90,"rel":91},"https://about.gitlab.com/solutions/public-sector/fedramp/",[],"FedRAMP",",\nPCI-DSS, etc., by adhering to security best practices and standards.",[25,95,96,99],{},[28,97,98],{},"Enhanced runtime security:"," Properly hardened images are less likely to\nbe compromised during runtime, providing better protection for the applications and data they contain.",[25,101,102,105],{},[28,103,104],{},"Increased operational efficiency:"," Minimal images are typically smaller\nin size, leading to faster deployment times and reduced resource consumption.",[12,107,108],{},"Chainguard provides more than 833 minimal, hardened images that can be easily built, shipped, and run. Container images can all be stored and managed directly in GitLab Container Registry. These solutions greatly minimize container security complexity.",[54,110,112],{"id":111},"chainguard-image-library","Chainguard image library",[12,114,115,116,121,122,127],{},"The ",[82,117,120],{"href":118,"rel":119},"https://images.chainguard.dev/",[],"Chainguard"," directory provides hardened, minimal container images to help developers build software from the onset. With 97.6% fewer vulnerabilities than the average image,\nChainguard Images help organizations swiftly reach container security compliance goals like ",[82,123,126],{"href":124,"rel":125},"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final",[],"NIST 800-53",", FedRAMP, or\nPCI-DSS.",[12,129,130],{},[131,132],"img",{"alt":133,"src":134},"Chainguard minimal, hardened container images featured section","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750098702/Blog/Content%20Images/Blog/Content%20Images/1__1__aHR0cHM6_1750098702263.png",[136,137,138],"center",{},[139,140,133],"em",{},[12,142,143],{},"These images can be accessed directly from the Chainguard Directory. All images have the following features:",[22,145,146,154,161,164],{},[25,147,148,149],{},"Build time-generated ",[82,150,153],{"href":151,"rel":152},"https://about.gitlab.com/blog/the-ultimate-guide-to-sboms/",[],"software bill of\nmaterials",[25,155,156],{},[82,157,160],{"href":158,"rel":159},"https://docs.gitlab.com/ci/yaml/signing_examples/",[],"Sigstore-powered attestation and\nprovenance",[25,162,163],{},"No vulnerabilities",[25,165,166,167,172],{},"Security advisory feed in\n",[82,168,171],{"href":169,"rel":170},"https://www.goldmansachs.com/our-firm/history/moments/1993-secdb",[],"SecDB","\nand OSV formats",[54,174,176],{"id":175},"using-chainguard-container-images-in-gitlab","Using Chainguard container images in GitLab",[12,178,179],{},"Chainguard container images can be used in the following ways:",[22,181,182,185],{},[25,183,184],{},"directly within GitLab to run jobs within a pipeline",[25,186,187],{},"stored in a Dockerfile in GitLab, which can be created, scanned for\nvulnerabilities, and pushed directly to the built-in container registry",[189,190,192],"h3",{"id":191},"using-chainguard-images-in-a-gitlab-job","Using Chainguard images in a GitLab job",[12,194,195,196,204,205,208,209,212,213,216],{},"To use a Chainguard image in a specific GitLab job, within your ",[82,197,200],{"href":198,"rel":199},"https://docs.gitlab.com/ci/yaml/",[],[201,202,203],"code",{},"gitlab-ci.yml",", simply set the ",[201,206,207],{},"image"," directive under the job definition to the image you wish to use. For example, the following job named ",[201,210,211],{},"unit-tests"," uses ",[201,214,215],{},"cgr.dev/chainguard/go:latest"," as the container image to run the job.",[218,219,224],"pre",{"className":220,"code":221,"language":222,"meta":223,"style":223},"language-yaml shiki shiki-themes github-light","stages:\n  - test\n\nunit-tests:\n  image: cgr.dev/chainguard/go:latest\n  stage: test\n  before_script:\n    - go mod download\n  script:\n    - go test -coverprofile=coverage.out\n  artifacts:\n    paths:\n      - coverage.out\n","yaml","",[201,225,226,239,249,256,263,275,285,293,302,310,318,326,334],{"__ignoreMap":223},[227,228,231,235],"span",{"class":229,"line":230},"line",1,[227,232,234],{"class":233},"shJU0","stages",[227,236,238],{"class":237},"sgsFI",":\n",[227,240,242,245],{"class":229,"line":241},2,[227,243,244],{"class":237},"  - ",[227,246,248],{"class":247},"sYBdl","test\n",[227,250,252],{"class":229,"line":251},3,[227,253,255],{"emptyLinePlaceholder":254},true,"\n",[227,257,259,261],{"class":229,"line":258},4,[227,260,211],{"class":233},[227,262,238],{"class":237},[227,264,266,269,272],{"class":229,"line":265},5,[227,267,268],{"class":233},"  image",[227,270,271],{"class":237},": ",[227,273,274],{"class":247},"cgr.dev/chainguard/go:latest\n",[227,276,278,281,283],{"class":229,"line":277},6,[227,279,280],{"class":233},"  stage",[227,282,271],{"class":237},[227,284,248],{"class":247},[227,286,288,291],{"class":229,"line":287},7,[227,289,290],{"class":233},"  before_script",[227,292,238],{"class":237},[227,294,296,299],{"class":229,"line":295},8,[227,297,298],{"class":237},"    - ",[227,300,301],{"class":247},"go mod download\n",[227,303,305,308],{"class":229,"line":304},9,[227,306,307],{"class":233},"  script",[227,309,238],{"class":237},[227,311,313,315],{"class":229,"line":312},10,[227,314,298],{"class":237},[227,316,317],{"class":247},"go test -coverprofile=coverage.out\n",[227,319,321,324],{"class":229,"line":320},11,[227,322,323],{"class":233},"  artifacts",[227,325,238],{"class":237},[227,327,329,332],{"class":229,"line":328},12,[227,330,331],{"class":233},"    paths",[227,333,238],{"class":237},[227,335,337,340],{"class":229,"line":336},13,[227,338,339],{"class":237},"      - ",[227,341,342],{"class":247},"coverage.out\n",[189,344,346],{"id":345},"using-chainguard-images-in-a-dockerfile","Using Chainguard images in a Dockerfile",[12,348,349],{},"To use a Chainguard image within a Dockerfile, simply create a Dockerfile in the root directory of your GitLab project. Then set the base image of the\nDockerfile to the Chainguard image you wish to use, and add any other required commands:",[218,351,355],{"className":352,"code":353,"language":354,"meta":223,"style":223},"language-dockerfile shiki shiki-themes github-light","FROM cgr.dev/chainguard/go:latest\nWORKDIR /app\nCOPY . .\nRUN go mod download\nRUN go build -o /main .\nCMD [“/main”]\n","dockerfile",[201,356,357,366,374,382,390,397],{"__ignoreMap":223},[227,358,359,363],{"class":229,"line":230},[227,360,362],{"class":361},"sD7c4","FROM",[227,364,365],{"class":237}," cgr.dev/chainguard/go:latest\n",[227,367,368,371],{"class":229,"line":241},[227,369,370],{"class":361},"WORKDIR",[227,372,373],{"class":237}," /app\n",[227,375,376,379],{"class":229,"line":251},[227,377,378],{"class":361},"COPY",[227,380,381],{"class":237}," . .\n",[227,383,384,387],{"class":229,"line":258},[227,385,386],{"class":361},"RUN",[227,388,389],{"class":237}," go mod download\n",[227,391,392,394],{"class":229,"line":265},[227,393,386],{"class":361},[227,395,396],{"class":237}," go build -o /main .\n",[227,398,399,402],{"class":229,"line":277},[227,400,401],{"class":361},"CMD",[227,403,404],{"class":237}," [“/main”]\n",[12,406,407,408,414,415,420],{},"Then, you can create a job in the ",[82,409,411],{"href":198,"rel":410},[],[201,412,413],{},".gitlab-ci.yml"," to log in to the ",[82,416,419],{"href":417,"rel":418},"https://docs.gitlab.com/user/packages/container_registry/",[],"built-in GitLab Container\nRegistry"," and push the image:",[218,422,424],{"className":220,"code":423,"language":222,"meta":223,"style":223},"build-app-image:\n  stage: build\n  image: docker:latest\n  services:\n    - docker:dind\n  variables:\n    IMAGE: $CI_REGISTRY_IMAGE/$CI_DEFAULT_BRANCH:latest\n  before_script:\n    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY\n  script:\n    - docker build -t $IMAGE .\n    - docker push $IMAGE\n",[201,425,426,433,442,451,458,465,472,482,488,495,501,508],{"__ignoreMap":223},[227,427,428,431],{"class":229,"line":230},[227,429,430],{"class":233},"build-app-image",[227,432,238],{"class":237},[227,434,435,437,439],{"class":229,"line":241},[227,436,280],{"class":233},[227,438,271],{"class":237},[227,440,441],{"class":247},"build\n",[227,443,444,446,448],{"class":229,"line":251},[227,445,268],{"class":233},[227,447,271],{"class":237},[227,449,450],{"class":247},"docker:latest\n",[227,452,453,456],{"class":229,"line":258},[227,454,455],{"class":233},"  services",[227,457,238],{"class":237},[227,459,460,462],{"class":229,"line":265},[227,461,298],{"class":237},[227,463,464],{"class":247},"docker:dind\n",[227,466,467,470],{"class":229,"line":277},[227,468,469],{"class":233},"  variables",[227,471,238],{"class":237},[227,473,474,477,479],{"class":229,"line":287},[227,475,476],{"class":233},"    IMAGE",[227,478,271],{"class":237},[227,480,481],{"class":247},"$CI_REGISTRY_IMAGE/$CI_DEFAULT_BRANCH:latest\n",[227,483,484,486],{"class":229,"line":295},[227,485,290],{"class":233},[227,487,238],{"class":237},[227,489,490,492],{"class":229,"line":304},[227,491,298],{"class":237},[227,493,494],{"class":247},"docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY\n",[227,496,497,499],{"class":229,"line":312},[227,498,307],{"class":233},[227,500,238],{"class":237},[227,502,503,505],{"class":229,"line":320},[227,504,298],{"class":237},[227,506,507],{"class":247},"docker build -t $IMAGE .\n",[227,509,510,512],{"class":229,"line":328},[227,511,298],{"class":237},[227,513,514],{"class":247},"docker push $IMAGE\n",[12,516,517,518,521],{},"Once the job completes, you can see the pushed images in GitLab Container\nRegistry by selecting ",[28,519,520],{},"Deploy > Container Registry"," from your project’s side tab.",[12,523,524],{},[131,525],{"alt":526,"src":527},"GitLab Container\nRegistry","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750098702/Blog/Content%20Images/Blog/Content%20Images/2__1__aHR0cHM6_1750098702268.png",[136,529,530],{},[139,531,532],{},"GitLab Container Registry",[12,534,535,538,539,544],{},[28,536,537],{},"Note:"," GitLab makes it easy to authenticate with the built-in container registry via ",[82,540,543],{"href":541,"rel":542},"https://docs.gitlab.com/user/packages/container_registry/authenticate_with_container_registry/#use-gitlab-cicd-to-authenticate",[],"reserved CI/CD variables","\nas seen above.",[54,546,548],{"id":547},"container-image-signing","Container image signing",[12,550,551],{},"Signing container images is a critical security measure to prevent tampering by verifying their authenticity, trust, and integrity:",[22,553,554,560,566],{},[25,555,556,559],{},[28,557,558],{},"Authenticity:"," Ensures the source of the image is trusted by verifying\nthe signature attached to an image with the public key from a trusted certificate authority.",[25,561,562,565],{},[28,563,564],{},"Trust:"," Image publishers and users can trust each other, allowing\nfrequent image sharing.",[25,567,568,571],{},[28,569,570],{},"Integrity:"," The signature includes a hash that can be checked to ensure\nthe image has not been altered since the signing.",[12,573,574,575,579,580,585],{},"The Sigstore project provides a CLI called Cosign, which can be used for keyless signing of container images. This eliminates the need to manage safeguards and rotate the private key that will be signing the image. GitLab provides ",[82,576,578],{"href":158,"rel":577},[],"container-signing","\nby allowing you to generate a private key via a token obtained from the\nGitLab server using the ",[82,581,584],{"href":582,"rel":583},"https://docs.gitlab.com/administration/auth/oidc/",[],"OIDC identity"," of the user who ran the job. The token includes unique claims that certify that a\nCI/CD pipeline generated the token.",[12,587,588],{},[131,589],{"alt":590,"src":591},"GitLab container image signature details","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750098702/Blog/Content%20Images/Blog/Content%20Images/3__1__aHR0cHM6_1750098702270.png",[136,593,594],{},[139,595,590],{},[12,597,598],{},"GitLab stores the container signature details in the container registry. A job can then be created to validate the signature against the certificate issuer using Cosign.",[600,601,603],"h1",{"id":602},"vulnerability-scanning-and-management","Vulnerability scanning and management",[12,605,606],{},"As you add more application dependencies to a hardened base image to achieve your goals, over time you may introduce vulnerabilities. By enabling security scanning provided by GitLab, you can address these risks as they come and reduce them. Additionally, when these vulnerabilities arise, vulnerability management tools are crucial for managing your security posture.",[54,608,610],{"id":609},"vulnerability-scanning-and-security-guardrails","Vulnerability scanning and security guardrails",[12,612,613],{},"It's necessary to regularly run security scans to avoid data breaches, reduce service downtime, and prevent loss of brand reputation. Some benefits of running security scans before code is deployed to production include:",[22,615,616,619,622,625,628],{},[25,617,618],{},"early detection and resolution",[25,620,621],{},"adherence to regulatory compliance",[25,623,624],{},"maintaining system uptime",[25,626,627],{},"building trust with customers",[25,629,630],{},"assessing and managing risk",[12,632,633],{},"GitLab provides several analyzers to scan various parts of your application for security vulnerabilities:",[635,636,637,650],"table",{},[638,639,640],"thead",{},[641,642,643,647],"tr",{},[644,645,646],"th",{},"Scanner Type",[644,648,649],{},"Description",[651,652,653,666,678,690,703,715,727,739],"tbody",{},[641,654,655,663],{},[656,657,658],"td",{},[82,659,662],{"href":660,"rel":661},"https://docs.gitlab.com/user/application_security/sast/",[],"Static Application Security Testing (SAST)",[656,664,665],{},"Scans static source code for known vulnerabilities (C/C++, Java, Python, Go, JavaScript, and many more languages).",[641,667,668,675],{},[656,669,670],{},[82,671,674],{"href":672,"rel":673},"https://docs.gitlab.com/user/application_security/dast/",[],"Dynamic Application Security Testing (DAST)",[656,676,677],{},"Runs automated penetration tests to find vulnerabilities in your web applications and APIs as they are running.",[641,679,680,687],{},[656,681,682],{},[82,683,686],{"href":684,"rel":685},"https://docs.gitlab.com/user/application_security/iac_scanning/",[],"Infrastructure as Code Scanning (IaC)",[656,688,689],{},"Scans infrastructure definition files for known vulnerabilities (Terraform, Ansible, AWS Cloudformation, Kubernetes, and many more).",[641,691,692,700],{},[656,693,694,699],{},[82,695,698],{"href":696,"rel":697},"https://docs.gitlab.com/user/application_security/container_scanning/",[],"Container Scanning"," (including image dependencies and licenses)",[656,701,702],{},"Scans container images for known vulnerabilities, including GitLab Container Registry, external registries, Kubernetes clusters; image dependencies and licenses are also scanned and compared to policy.",[641,704,705,712],{},[656,706,707],{},[82,708,711],{"href":709,"rel":710},"https://docs.gitlab.com/user/application_security/dependency_scanning/",[],"Dependency Scanning and License Compliance",[656,713,714],{},"Scans your application’s dependencies for known vulnerabilities across NuGet, Gradle, Maven, pip, npm, yarn, and more; dependency licenses are also scanned and compared to policy.",[641,716,717,724],{},[656,718,719],{},[82,720,723],{"href":721,"rel":722},"https://docs.gitlab.com/user/application_security/secret_detection/",[],"Secret Detection",[656,725,726],{},"Scans your repository for secrets (keys, passwords) across all text files regardless of language or framework; can block pushes or warn in-browser.",[641,728,729,736],{},[656,730,731],{},[82,732,735],{"href":733,"rel":734},"https://docs.gitlab.com/user/application_security/api_fuzzing/",[],"Web API Fuzzing",[656,737,738],{},"Sets operation parameters to unexpected values to cause unexpected behavior and errors in the API backend.",[641,740,741,748],{},[656,742,743],{},[82,744,747],{"href":745,"rel":746},"https://docs.gitlab.com/user/application_security/coverage_fuzzing/",[],"Coverage-guided Fuzzing",[656,749,750],{},"Sends random inputs to an instrumented version of your application to cause unexpected behavior.",[12,752,753,754,756,757,762,763,765],{},"These scanners can be easily added to your pipeline by simply importing the appropriate scanner template in your ",[201,755,413],{},". For example, to ",[82,758,761],{"href":759,"rel":760},"https://docs.gitlab.com/user/application_security/sast/#configure-sast-in-your-cicd-yaml",[],"enable\nSAST",", simply add the following to your ",[201,764,413],{},":",[218,767,769],{"className":220,"code":768,"language":222,"meta":223,"style":223},"stages:\n  - test\n\ninclude:\n  - template: Jobs/SAST.gitlab-ci.yml\n",[201,770,771,777,783,787,794],{"__ignoreMap":223},[227,772,773,775],{"class":229,"line":230},[227,774,234],{"class":233},[227,776,238],{"class":237},[227,778,779,781],{"class":229,"line":241},[227,780,244],{"class":237},[227,782,248],{"class":247},[227,784,785],{"class":229,"line":251},[227,786,255],{"emptyLinePlaceholder":254},[227,788,789,792],{"class":229,"line":258},[227,790,791],{"class":233},"include",[227,793,238],{"class":237},[227,795,796,798,801,803],{"class":229,"line":265},[227,797,244],{"class":237},[227,799,800],{"class":233},"template",[227,802,271],{"class":237},[227,804,805],{"class":247},"Jobs/SAST.gitlab-ci.yml\n",[12,807,808,809,765],{},"Once you've enabled the scanners, whenever you create a merge request to commit code from a feature branch into another branch, ",[82,810,813],{"href":811,"rel":812},"https://docs.gitlab.com/user/application_security/#view-security-scan-information",[],"scanner results will display directly within the\nMR",[12,815,816],{},[131,817],{"alt":818,"src":819},"GitLab security scanner findings displayed in\nMR","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750098702/Blog/Content%20Images/Blog/Content%20Images/4_aHR0cHM6_1750098702271.png",[136,821,822],{},[139,823,824],{},"GitLab security scanner findings displayed in MR",[12,826,827],{},"These results allow developers to quickly assess, prioritize, and mitigate or remediate vulnerabilities by providing the following information:",[22,829,830,833,836,839,842,845],{},[25,831,832],{},"description",[25,834,835],{},"severity",[25,837,838],{},"location",[25,840,841],{},"links and identifiers",[25,843,844],{},"training",[25,846,847],{},"solutions",[12,849,850],{},[131,851],{"alt":852,"src":853},"GitLab security scanner vulnerability details","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750098702/Blog/Content%20Images/Blog/Content%20Images/5_aHR0cHM6_1750098702272.png",[136,855,856],{},[139,857,852],{},[12,859,860],{},"Additional actions can be taken on a vulnerability, such as:",[22,862,863,866],{},[25,864,865],{},"dismissing the vulnerability and providing a reason to allow quicker\nreview from the security team",[25,867,868],{},"creating an issue to collaborate later on a resolution",[12,870,871,873],{},[28,872,537],{}," Scanners can also be configured and/or extended using variables and pipeline directives, just like any other GitLab job.",[189,875,877],{"id":876},"security-guardrails","Security guardrails",[12,879,880,881,886],{},"The scanners mentioned above can be used along with ",[82,882,885],{"href":883,"rel":884},"https://docs.gitlab.com/user/application_security/policies/",[],"security policies"," to prevent insecure code from being merged into production and to ensure that the scanners are run on every pipeline. GitLab provides the following security policy types:",[22,888,889,895,901],{},[25,890,891,894],{},[28,892,893],{},"Merge request approval policy:","  Create rules that check for security\nvulnerabilities and license compliance before merging a merge request.",[25,896,897,900],{},[28,898,899],{},"Scan execution policy:"," Create rules that enforce security scans for\nparticular branches at a certain time.",[25,902,903,906],{},[28,904,905],{},"Pipeline execution policy:"," Enforce a custom CI/CD configuration to run\nin project pipelines.",[12,908,909],{},"Implementing these policies ensures that when creating an MR, security scans and custom compliance jobs will be run, and that approval will be required if vulnerabilities or incompatible licenses are detected:",[12,911,912],{},[131,913],{"alt":914,"src":915},"Merge request approval required due to vulnerabilities and incompatible licenses","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750098702/Blog/Content%20Images/Blog/Content%20Images/6_aHR0cHM6_1750098702273.png",[136,917,918],{},[139,919,914],{},[54,921,923],{"id":922},"vulnerability-reports","Vulnerability reports",[12,925,926],{},"Detecting vulnerabilities before they make it to production is important, but it is equally important to determine and manage vulnerabilities that make their way into production, so that they can be mitigated accordingly.",[12,928,929,934],{},[82,930,933],{"href":931,"rel":932},"https://docs.gitlab.com/user/application_security/vulnerability_report/",[],"GitLab Vulnerability\nReport","\nprovides information on all the detected vulnerabilities from scans of the default branch (which may be your staging or production branch):",[12,936,937],{},[131,938],{"alt":939,"src":940},"Vulnerability report with filters applied","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750098702/Blog/Content%20Images/Blog/Content%20Images/7_aHR0cHM6_1750098702274.png",[136,942,943],{},[139,944,939],{},[12,946,947],{},"If you select a vulnerability, you’ll be taken to its vulnerability page, which displays the same vulnerability details as you would see in the MR view. You can use this view to quickly assess, prioritize, and mitigate or remediate vulnerabilities:",[12,949,950],{},[131,951],{"alt":952,"src":953},"Vulnerability page for improper authorization vulnerability","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750098702/Blog/Content%20Images/Blog/Content%20Images/8_aHR0cHM6_1750098702275.png",[136,955,956],{},[139,957,952],{},[12,959,960],{},"The security team can manage vulnerabilities by setting their status to one of the following:",[22,962,963,966,969,972],{},[25,964,965],{},"Detected: The default state for a newly discovered vulnerability.",[25,967,968],{},"Confirmed: A user has seen this vulnerability and confirmed it is\naccurate.",[25,970,971],{},"Dismissed: A user has seen this vulnerability and dismissed it because it\nis inaccurate or otherwise not to be resolved. Dismissed vulnerabilities are ignored if detected in subsequent scans.",[25,973,974],{},"Resolved: The vulnerability has been fixed or is no longer present. If a\nresolved vulnerability is reintroduced and detected again, its record is reinstated and its status set to detected.",[54,976,978],{"id":977},"software-bill-of-materials","Software bill of materials",[12,980,981],{},"A software bill of materials (SBOM) is a comprehensive inventory that lists all the components, dependencies, and associated metadata of a software application. SBOMs are vital for organizations to effectively manage software security, compliance, and supply chain risks.",[12,983,984,985,990,991,996],{},"Chainguard provides high-quality, ",[82,986,989],{"href":987,"rel":988},"https://images.chainguard.dev/directory/image/go/sbom",[],"out-of-the-box\nSBOMs"," for their container images in SPDX format. The SBOM can be converted into CycloneDX format and loaded into or compared with the results of GitLab’s dependency list. The ",[82,992,995],{"href":993,"rel":994},"https://docs.gitlab.com/user/application_security/dependency_list/",[],"dependency list","\nis an SBOM generated from an artifact or the results of the dependency, container, and license scanners:",[12,998,999],{},[131,1000],{"alt":1001,"src":1002},"Dependency List with some components expanded","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750098702/Blog/Content%20Images/Blog/Content%20Images/9_aHR0cHM6_1750098702276.png",[136,1004,1005],{},[139,1006,1001],{},[12,1008,1009,1010,1015,1016,1021],{},"Chainguard images meet ",[82,1011,1014],{"href":1012,"rel":1013},"https://slsa.dev/spec/v0.1/levels?ref=fossa.com",[],"SLSA Level 2 requirements"," and are verified, signed, and attested with signatures. Furthermore, GitLab CI can ",[82,1017,1020],{"href":1018,"rel":1019},"https://docs.gitlab.com/ci/runners/configure_runners/#artifact-provenance-metadata",[],"generate and produce attestation/provenance metadata","\nfor all build artifacts. By using Chainguard with GitLab, you can prevent tampering and provide additional build integrity guarantees.",[54,1023,1025],{"id":1024},"learn-more","Learn more",[12,1027,1028],{},"To learn more about GitLab and Chainguard, and how we can help enhance your security posture, check out the following resources:",[22,1030,1031,1038,1045,1052,1059,1066],{},[25,1032,1033],{},[82,1034,1037],{"href":1035,"rel":1036},"https://about.gitlab.com/solutions/application-security-testing/",[],"GitLab Security and Compliance\nSolutions",[25,1039,1040],{},[82,1041,1044],{"href":1042,"rel":1043},"https://docs.gitlab.com/user/application_security/get-started-security/",[],"GitLab Application Security\nDocumentation",[25,1046,1047],{},[82,1048,1051],{"href":1049,"rel":1050},"https://about.gitlab.com/pricing/",[],"GitLab pricing",[25,1053,1054],{},[82,1055,1058],{"href":1056,"rel":1057},"https://www.chainguard.dev/chainguard-images",[],"Chainguard Images",[25,1060,1061],{},[82,1062,1065],{"href":1063,"rel":1064},"https://www.chainguard.dev/solutions/compliance-and-risk-mitigation",[],"Chainguard Compliance and Risk\nMitigation",[25,1067,1068],{},[82,1069,1072],{"href":1070,"rel":1071},"https://www.chainguard.dev/contact?utm_source=blog&utm_medium=partner&utm_campaign=GitLab_announcement_blog&utm_content=article",[],"Chainguard\nSales",[1074,1075,1076],"style",{},"html pre.shiki code .shJU0, html code.shiki .shJU0{--shiki-default:#22863A}html pre.shiki code .sgsFI, html code.shiki .sgsFI{--shiki-default:#24292E}html pre.shiki code .sYBdl, html code.shiki .sYBdl{--shiki-default:#032F62}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sD7c4, html code.shiki .sD7c4{--shiki-default:#D73A49}",{"title":223,"searchDepth":241,"depth":241,"links":1078},[1079,1080,1081,1085,1086,1089,1090,1091],{"id":56,"depth":241,"text":57},{"id":111,"depth":241,"text":112},{"id":175,"depth":241,"text":176,"children":1082},[1083,1084],{"id":191,"depth":251,"text":192},{"id":345,"depth":251,"text":346},{"id":547,"depth":241,"text":548},{"id":609,"depth":241,"text":610,"children":1087},[1088],{"id":876,"depth":251,"text":877},{"id":922,"depth":241,"text":923},{"id":977,"depth":241,"text":978},{"id":1024,"depth":241,"text":1025},"security","2024-09-09","Learn how GitLab + Chainguard can help deliver secure containerized applications faster. This tutorial includes easy-to-follow code examples.","md",null,false,"https://res.cloudinary.com/about-gitlab-com/image/upload/v1750098693/Blog/Hero%20Images/Blog/Hero%20Images/blog-image-template-1800x945%20%2823%29_2w6waL76KROjhJHM2vXet6_1750098693265.png",{},"/en-us/blog/secure-open-source-container-infrastructure-with-gitlab-and-chainguard",{"ogTitle":5,"ogImage":1098,"ogDescription":1094,"ogSiteName":1102,"noIndex":1097,"ogType":1103,"ogUrl":1104,"title":5,"canonicalUrls":1104,"description":1094},"https://about.gitlab.com","article","https://about.gitlab.com/blog/secure-open-source-container-infrastructure-with-gitlab-and-chainguard","secure-open-source-container-infrastructure-with-gitlab-and-chainguard","en-us/blog/secure-open-source-container-infrastructure-with-gitlab-and-chainguard","BlogPost","EIqQaJavVAj4U2p6f047TH1oHX-ovVBAWZAnz90l_EI",{"logo":1110,"freeTrial":1115,"sales":1120,"login":1125,"items":1130,"search":1455,"minimal":1486,"duo":1505,"switchNav":1514,"pricingDeployment":1525},{"config":1111},{"href":1112,"dataGaName":1113,"dataGaLocation":1114},"/","gitlab logo","header",{"text":1116,"config":1117},"Get free trial",{"href":1118,"dataGaName":1119,"dataGaLocation":1114},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":1121,"config":1122},"Request a demo",{"href":1123,"dataGaName":1124,"dataGaLocation":1114},"/sales/?contact-topic=request-demo","sales",{"text":1126,"config":1127},"Sign in",{"href":1128,"dataGaName":1129,"dataGaLocation":1114},"https://gitlab.com/users/sign_in/","sign in",[1131,1159,1258,1263,1377,1433],{"text":1132,"config":1133,"menu":1135},"Platform",{"dataNavLevelOne":1134},"platform",{"type":1136,"columns":1137},"cards",[1138,1144,1152],{"title":1132,"description":1139,"link":1140},"The intelligent orchestration platform for DevSecOps",{"text":1141,"config":1142},"Explore our Platform",{"href":1143,"dataGaName":1134,"dataGaLocation":1114},"/platform/",{"title":1145,"description":1146,"link":1147},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":1148,"config":1149},"Meet GitLab Duo",{"href":1150,"dataGaName":1151,"dataGaLocation":1114},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":1153,"description":1154,"link":1155},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":1025,"config":1156},{"href":1157,"dataGaName":1158,"dataGaLocation":1114},"/why-gitlab/","why gitlab",{"text":1160,"left":254,"config":1161,"menu":1162},"Product",{"dataNavLevelOne":847},{"type":1163,"link":1164,"columns":1168,"feature":1237},"lists",{"text":1165,"config":1166},"View all Solutions",{"href":1167,"dataGaName":847,"dataGaLocation":1114},"/solutions/",[1169,1193,1216],{"title":1170,"description":1171,"link":1172,"items":1177},"Automation","CI/CD and automation to accelerate deployment",{"config":1173},{"icon":1174,"href":1175,"dataGaName":1176,"dataGaLocation":1114},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[1178,1182,1185,1189],{"text":1179,"config":1180},"CI/CD",{"href":1181,"dataGaLocation":1114,"dataGaName":1179},"/solutions/continuous-integration/",{"text":1145,"config":1183},{"href":1150,"dataGaLocation":1114,"dataGaName":1184},"gitlab duo agent platform - product menu",{"text":1186,"config":1187},"Source Code Management",{"href":1188,"dataGaLocation":1114,"dataGaName":1186},"/solutions/source-code-management/",{"text":1190,"config":1191},"Automated Software Delivery",{"href":1175,"dataGaLocation":1114,"dataGaName":1192},"Automated software delivery",{"title":1194,"description":1195,"link":1196,"items":1201},"Security","Deliver code faster without compromising security",{"config":1197},{"href":1198,"dataGaName":1199,"dataGaLocation":1114,"icon":1200},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[1202,1206,1211],{"text":1203,"config":1204},"Application Security Testing",{"href":1198,"dataGaName":1205,"dataGaLocation":1114},"Application security testing",{"text":1207,"config":1208},"Software Supply Chain Security",{"href":1209,"dataGaLocation":1114,"dataGaName":1210},"/solutions/supply-chain/","Software supply chain security",{"text":1212,"config":1213},"Software Compliance",{"href":1214,"dataGaName":1215,"dataGaLocation":1114},"/solutions/software-compliance/","software compliance",{"title":1217,"link":1218,"items":1223},"Measurement",{"config":1219},{"icon":1220,"href":1221,"dataGaName":1222,"dataGaLocation":1114},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[1224,1228,1232],{"text":1225,"config":1226},"Visibility & Measurement",{"href":1221,"dataGaLocation":1114,"dataGaName":1227},"Visibility and Measurement",{"text":1229,"config":1230},"Value Stream Management",{"href":1231,"dataGaLocation":1114,"dataGaName":1229},"/solutions/value-stream-management/",{"text":1233,"config":1234},"Analytics & Insights",{"href":1235,"dataGaLocation":1114,"dataGaName":1236},"/solutions/analytics-and-insights/","Analytics and insights",{"title":1238,"type":1163,"items":1239},"GitLab for",[1240,1246,1252],{"text":1241,"config":1242},"Enterprise",{"icon":1243,"href":1244,"dataGaLocation":1114,"dataGaName":1245},"Building","/enterprise/","enterprise",{"text":1247,"config":1248},"Small Business",{"icon":1249,"href":1250,"dataGaLocation":1114,"dataGaName":1251},"Work","/small-business/","small business",{"text":1253,"config":1254},"Public Sector",{"icon":1255,"href":1256,"dataGaLocation":1114,"dataGaName":1257},"Organization","/solutions/public-sector/","public sector",{"text":1259,"config":1260},"Pricing",{"href":1261,"dataGaName":1262,"dataGaLocation":1114,"dataNavLevelOne":1262},"/pricing/","pricing",{"text":1264,"config":1265,"menu":1267},"Resources",{"dataNavLevelOne":1266},"resources",{"type":1163,"link":1268,"columns":1272,"feature":1366},{"text":1269,"config":1270},"View all resources",{"href":1271,"dataGaName":1266,"dataGaLocation":1114},"/resources/",[1273,1306,1333],{"title":1274,"items":1275},"Getting started",[1276,1281,1286,1291,1296,1301],{"text":1277,"config":1278},"Install",{"href":1279,"dataGaName":1280,"dataGaLocation":1114},"/install/","install",{"text":1282,"config":1283},"Quick start guides",{"href":1284,"dataGaName":1285,"dataGaLocation":1114},"/get-started/","quick setup checklists",{"text":1287,"config":1288},"Learn",{"href":1289,"dataGaLocation":1114,"dataGaName":1290},"https://university.gitlab.com/","learn",{"text":1292,"config":1293},"Product documentation",{"href":1294,"dataGaName":1295,"dataGaLocation":1114},"https://docs.gitlab.com/","product documentation",{"text":1297,"config":1298},"Best practice videos",{"href":1299,"dataGaName":1300,"dataGaLocation":1114},"/getting-started-videos/","best practice videos",{"text":1302,"config":1303},"Integrations",{"href":1304,"dataGaName":1305,"dataGaLocation":1114},"/integrations/","integrations",{"title":1307,"items":1308},"Discover",[1309,1314,1319,1324,1328],{"text":1310,"config":1311},"Customer success stories",{"href":1312,"dataGaName":1313,"dataGaLocation":1114},"/customers/","customer success stories",{"text":1315,"config":1316},"Blog",{"href":1317,"dataGaName":1318,"dataGaLocation":1114},"/blog/","blog",{"text":1320,"config":1321},"Demo Hub",{"href":1322,"dataGaName":1323,"dataGaLocation":1114},"/demo-hub/","demo hub",{"text":1325,"config":1326},"The Source",{"href":1327,"dataGaName":1318,"dataGaLocation":1114},"/the-source/",{"text":1329,"config":1330},"Remote",{"href":1331,"dataGaName":1332,"dataGaLocation":1114},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":1334,"items":1335},"Connect",[1336,1341,1346,1351,1356,1361],{"text":1337,"config":1338},"GitLab Services",{"href":1339,"dataGaName":1340,"dataGaLocation":1114},"/services/","services",{"text":1342,"config":1343},"Contribute",{"href":1344,"dataGaName":1345,"dataGaLocation":1114},"https://contributors.gitlab.com","contribute",{"text":1347,"config":1348},"Community",{"href":1349,"dataGaName":1350,"dataGaLocation":1114},"/community/","community",{"text":1352,"config":1353},"Forum",{"href":1354,"dataGaName":1355,"dataGaLocation":1114},"https://forum.gitlab.com/","forum",{"text":1357,"config":1358},"Events",{"href":1359,"dataGaName":1360,"dataGaLocation":1114},"/events/","events",{"text":1362,"config":1363},"Partners",{"href":1364,"dataGaName":1365,"dataGaLocation":1114},"/partners/","partners",{"config":1367,"title":1370,"text":1371,"link":1372},{"background":1368,"textColor":1369},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":1373,"config":1374},"Read the latest",{"href":1375,"dataGaName":1376,"dataGaLocation":1114},"/whats-new/","whats new",{"text":1378,"config":1379,"menu":1381},"Company",{"dataNavLevelOne":1380},"company",{"type":1163,"columns":1382},[1383],{"items":1384},[1385,1390,1396,1398,1403,1408,1413,1418,1423,1428],{"text":1386,"config":1387},"About",{"href":1388,"dataGaName":1389,"dataGaLocation":1114},"/company/","about",{"text":1391,"config":1392,"footerGa":1395},"Jobs",{"href":1393,"dataGaName":1394,"dataGaLocation":1114},"/jobs/","jobs",{"dataGaName":1394},{"text":1357,"config":1397},{"href":1359,"dataGaName":1360,"dataGaLocation":1114},{"text":1399,"config":1400},"Leadership",{"href":1401,"dataGaName":1402,"dataGaLocation":1114},"/company/team/e-group/","leadership",{"text":1404,"config":1405},"Handbook",{"href":1406,"dataGaName":1407,"dataGaLocation":1114},"https://handbook.gitlab.com/","handbook",{"text":1409,"config":1410},"Investor relations",{"href":1411,"dataGaName":1412,"dataGaLocation":1114},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":1414,"config":1415},"Trust Center",{"href":1416,"dataGaName":1417,"dataGaLocation":1114},"/security/","trust center",{"text":1419,"config":1420},"AI Transparency Center",{"href":1421,"dataGaName":1422,"dataGaLocation":1114},"/ai-transparency-center/","ai transparency center",{"text":1424,"config":1425},"Newsletter",{"href":1426,"dataGaName":1427,"dataGaLocation":1114},"/company/contact/#contact-forms","newsletter",{"text":1429,"config":1430},"Press",{"href":1431,"dataGaName":1432,"dataGaLocation":1114},"/press/","press",{"text":1434,"config":1435,"menu":1436},"Contact us",{"dataNavLevelOne":1380},{"type":1163,"columns":1437},[1438],{"items":1439},[1440,1445,1450],{"text":1441,"config":1442},"Talk to sales",{"href":1443,"dataGaName":1444,"dataGaLocation":1114},"/sales/","talk to sales",{"text":1446,"config":1447},"Support portal",{"href":1448,"dataGaName":1449,"dataGaLocation":1114},"https://support.gitlab.com/hc/en-us","support portal",{"text":1451,"config":1452},"Customer portal",{"href":1453,"dataGaName":1454,"dataGaLocation":1114},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":1456,"login":1457,"suggestions":1464},"Close",{"text":1458,"link":1459},"To search repositories and projects, login to",{"text":1460,"config":1461},"gitlab.com",{"href":1128,"dataGaName":1462,"dataGaLocation":1463},"search login","search",{"text":1465,"default":1466},"Suggestions",[1467,1469,1473,1475,1479,1483],{"text":1145,"config":1468},{"href":1150,"dataGaName":1145,"dataGaLocation":1463},{"text":1470,"config":1471},"Code Suggestions (AI)",{"href":1472,"dataGaName":1470,"dataGaLocation":1463},"/solutions/code-suggestions/",{"text":1179,"config":1474},{"href":1181,"dataGaName":1179,"dataGaLocation":1463},{"text":1476,"config":1477},"GitLab on AWS",{"href":1478,"dataGaName":1476,"dataGaLocation":1463},"/partners/technology-partners/aws/",{"text":1480,"config":1481},"GitLab on Google Cloud",{"href":1482,"dataGaName":1480,"dataGaLocation":1463},"/partners/technology-partners/google-cloud-platform/",{"text":1484,"config":1485},"Why GitLab?",{"href":1157,"dataGaName":1484,"dataGaLocation":1463},{"freeTrial":1487,"mobileIcon":1492,"desktopIcon":1497,"secondaryButton":1500},{"text":1488,"config":1489},"Start free trial",{"href":1490,"dataGaName":1119,"dataGaLocation":1491},"https://gitlab.com/-/trials/new/","nav",{"altText":1493,"config":1494},"Gitlab Icon",{"src":1495,"dataGaName":1496,"dataGaLocation":1491},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":1493,"config":1498},{"src":1499,"dataGaName":1496,"dataGaLocation":1491},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":1501,"config":1502},"Get Started",{"href":1503,"dataGaName":1504,"dataGaLocation":1491},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":1506,"mobileIcon":1510,"desktopIcon":1512},{"text":1507,"config":1508},"Learn more about GitLab Duo",{"href":1150,"dataGaName":1509,"dataGaLocation":1491},"gitlab duo",{"altText":1493,"config":1511},{"src":1495,"dataGaName":1496,"dataGaLocation":1491},{"altText":1493,"config":1513},{"src":1499,"dataGaName":1496,"dataGaLocation":1491},{"button":1515,"mobileIcon":1520,"desktopIcon":1522},{"text":1516,"config":1517},"/switch",{"href":1518,"dataGaName":1519,"dataGaLocation":1491},"#contact","switch",{"altText":1493,"config":1521},{"src":1495,"dataGaName":1496,"dataGaLocation":1491},{"altText":1493,"config":1523},{"src":1524,"dataGaName":1496,"dataGaLocation":1491},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":1526,"mobileIcon":1531,"desktopIcon":1533},{"text":1527,"config":1528},"Back to pricing",{"href":1261,"dataGaName":1529,"dataGaLocation":1491,"icon":1530},"back to pricing","GoBack",{"altText":1493,"config":1532},{"src":1495,"dataGaName":1496,"dataGaLocation":1491},{"altText":1493,"config":1534},{"src":1499,"dataGaName":1496,"dataGaLocation":1491},{"title":1536,"titleMobile":1537,"button":1538,"config":1543},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":1025,"config":1539},{"href":1540,"dataGaName":1541,"dataGaLocation":1542},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":1544,"disabled":1097},"release",{"data":1546},{"text":1547,"source":1548,"edit":1554,"contribute":1559,"config":1564,"items":1569,"minimal":1779},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":1549,"config":1550},"View page source",{"href":1551,"dataGaName":1552,"dataGaLocation":1553},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":1555,"config":1556},"Edit this page",{"href":1557,"dataGaName":1558,"dataGaLocation":1553},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":1560,"config":1561},"Please contribute",{"href":1562,"dataGaName":1563,"dataGaLocation":1553},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":1565,"facebook":1566,"youtube":1567,"linkedin":1568},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[1570,1617,1671,1715,1747],{"title":1259,"links":1571,"subMenu":1586},[1572,1576,1581],{"text":1573,"config":1574},"View plans",{"href":1261,"dataGaName":1575,"dataGaLocation":1553},"view plans",{"text":1577,"config":1578},"Why Premium?",{"href":1579,"dataGaName":1580,"dataGaLocation":1553},"/pricing/premium/","why premium",{"text":1582,"config":1583},"Why Ultimate?",{"href":1584,"dataGaName":1585,"dataGaLocation":1553},"/pricing/ultimate/","why ultimate",[1587],{"title":1588,"links":1589},"Contact Us",[1590,1593,1595,1597,1602,1607,1612],{"text":1591,"config":1592},"Contact sales",{"href":1443,"dataGaName":1124,"dataGaLocation":1553},{"text":1446,"config":1594},{"href":1448,"dataGaName":1449,"dataGaLocation":1553},{"text":1451,"config":1596},{"href":1453,"dataGaName":1454,"dataGaLocation":1553},{"text":1598,"config":1599},"Status",{"href":1600,"dataGaName":1601,"dataGaLocation":1553},"https://status.gitlab.com/","status",{"text":1603,"config":1604},"Terms of use",{"href":1605,"dataGaName":1606,"dataGaLocation":1553},"/terms/","terms of use",{"text":1608,"config":1609},"Privacy statement",{"href":1610,"dataGaName":1611,"dataGaLocation":1553},"/privacy/","privacy statement",{"text":1613,"config":1614},"Cookie preferences",{"dataGaName":1615,"dataGaLocation":1553,"id":1616,"isOneTrustButton":254},"cookie preferences","ot-sdk-btn",{"title":1160,"links":1618,"subMenu":1627},[1619,1623],{"text":1620,"config":1621},"DevSecOps platform",{"href":1143,"dataGaName":1622,"dataGaLocation":1553},"devsecops platform",{"text":1624,"config":1625},"AI-Assisted Development",{"href":1150,"dataGaName":1626,"dataGaLocation":1553},"ai-assisted development",[1628],{"title":1629,"links":1630},"Topics",[1631,1636,1641,1646,1651,1656,1661,1666],{"text":1632,"config":1633},"CICD",{"href":1634,"dataGaName":1635,"dataGaLocation":1553},"/topics/ci-cd/","cicd",{"text":1637,"config":1638},"GitOps",{"href":1639,"dataGaName":1640,"dataGaLocation":1553},"/topics/gitops/","gitops",{"text":1642,"config":1643},"DevOps",{"href":1644,"dataGaName":1645,"dataGaLocation":1553},"/topics/devops/","devops",{"text":1647,"config":1648},"Version Control",{"href":1649,"dataGaName":1650,"dataGaLocation":1553},"/topics/version-control/","version control",{"text":1652,"config":1653},"DevSecOps",{"href":1654,"dataGaName":1655,"dataGaLocation":1553},"/topics/devsecops/","devsecops",{"text":1657,"config":1658},"Cloud Native",{"href":1659,"dataGaName":1660,"dataGaLocation":1553},"/topics/cloud-native/","cloud native",{"text":1662,"config":1663},"AI for Coding",{"href":1664,"dataGaName":1665,"dataGaLocation":1553},"/topics/devops/ai-for-coding/","ai for coding",{"text":1667,"config":1668},"Agentic AI",{"href":1669,"dataGaName":1670,"dataGaLocation":1553},"/topics/agentic-ai/","agentic ai",{"title":1672,"links":1673},"Solutions",[1674,1676,1678,1683,1687,1690,1694,1697,1699,1702,1705,1710],{"text":1203,"config":1675},{"href":1198,"dataGaName":1203,"dataGaLocation":1553},{"text":1192,"config":1677},{"href":1175,"dataGaName":1176,"dataGaLocation":1553},{"text":1679,"config":1680},"Agile development",{"href":1681,"dataGaName":1682,"dataGaLocation":1553},"/solutions/agile-delivery/","agile delivery",{"text":1684,"config":1685},"SCM",{"href":1188,"dataGaName":1686,"dataGaLocation":1553},"source code management",{"text":1632,"config":1688},{"href":1181,"dataGaName":1689,"dataGaLocation":1553},"continuous integration & delivery",{"text":1691,"config":1692},"Value stream management",{"href":1231,"dataGaName":1693,"dataGaLocation":1553},"value stream management",{"text":1637,"config":1695},{"href":1696,"dataGaName":1640,"dataGaLocation":1553},"/solutions/gitops/",{"text":1241,"config":1698},{"href":1244,"dataGaName":1245,"dataGaLocation":1553},{"text":1700,"config":1701},"Small business",{"href":1250,"dataGaName":1251,"dataGaLocation":1553},{"text":1703,"config":1704},"Public sector",{"href":1256,"dataGaName":1257,"dataGaLocation":1553},{"text":1706,"config":1707},"Education",{"href":1708,"dataGaName":1709,"dataGaLocation":1553},"/solutions/education/","education",{"text":1711,"config":1712},"Financial services",{"href":1713,"dataGaName":1714,"dataGaLocation":1553},"/solutions/finance/","financial services",{"title":1264,"links":1716},[1717,1719,1721,1723,1726,1728,1731,1733,1735,1737,1739,1741,1743,1745],{"text":1277,"config":1718},{"href":1279,"dataGaName":1280,"dataGaLocation":1553},{"text":1282,"config":1720},{"href":1284,"dataGaName":1285,"dataGaLocation":1553},{"text":1287,"config":1722},{"href":1289,"dataGaName":1290,"dataGaLocation":1553},{"text":1292,"config":1724},{"href":1294,"dataGaName":1725,"dataGaLocation":1553},"docs",{"text":1315,"config":1727},{"href":1317,"dataGaName":1318,"dataGaLocation":1553},{"text":1729,"config":1730},"What's new",{"href":1375,"dataGaName":1376,"dataGaLocation":1553},{"text":1310,"config":1732},{"href":1312,"dataGaName":1313,"dataGaLocation":1553},{"text":1329,"config":1734},{"href":1331,"dataGaName":1332,"dataGaLocation":1553},{"text":1337,"config":1736},{"href":1339,"dataGaName":1340,"dataGaLocation":1553},{"text":1342,"config":1738},{"href":1344,"dataGaName":1345,"dataGaLocation":1553},{"text":1347,"config":1740},{"href":1349,"dataGaName":1350,"dataGaLocation":1553},{"text":1352,"config":1742},{"href":1354,"dataGaName":1355,"dataGaLocation":1553},{"text":1357,"config":1744},{"href":1359,"dataGaName":1360,"dataGaLocation":1553},{"text":1362,"config":1746},{"href":1364,"dataGaName":1365,"dataGaLocation":1553},{"title":1378,"links":1748},[1749,1751,1753,1755,1757,1759,1763,1768,1770,1772,1774],{"text":1386,"config":1750},{"href":1388,"dataGaName":1380,"dataGaLocation":1553},{"text":1391,"config":1752},{"href":1393,"dataGaName":1394,"dataGaLocation":1553},{"text":1399,"config":1754},{"href":1401,"dataGaName":1402,"dataGaLocation":1553},{"text":1404,"config":1756},{"href":1406,"dataGaName":1407,"dataGaLocation":1553},{"text":1409,"config":1758},{"href":1411,"dataGaName":1412,"dataGaLocation":1553},{"text":1760,"config":1761},"Sustainability",{"href":1762,"dataGaName":1760,"dataGaLocation":1553},"/sustainability/",{"text":1764,"config":1765},"Diversity, inclusion and belonging (DIB)",{"href":1766,"dataGaName":1767,"dataGaLocation":1553},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":1414,"config":1769},{"href":1416,"dataGaName":1417,"dataGaLocation":1553},{"text":1424,"config":1771},{"href":1426,"dataGaName":1427,"dataGaLocation":1553},{"text":1429,"config":1773},{"href":1431,"dataGaName":1432,"dataGaLocation":1553},{"text":1775,"config":1776},"Modern Slavery Transparency Statement",{"href":1777,"dataGaName":1778,"dataGaLocation":1553},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":1780},[1781,1784,1787],{"text":1782,"config":1783},"Terms",{"href":1605,"dataGaName":1606,"dataGaLocation":1553},{"text":1785,"config":1786},"Cookies",{"dataGaName":1615,"dataGaLocation":1553,"id":1616,"isOneTrustButton":254},{"text":1788,"config":1789},"Privacy",{"href":1610,"dataGaName":1611,"dataGaLocation":1553},[1791],{"id":1792,"title":7,"body":1096,"config":1793,"content":1795,"description":1096,"extension":1799,"meta":1800,"navigation":254,"path":1801,"seo":1802,"stem":1803,"__hash__":1804},"blogAuthors/en-us/blog/authors/fernando-diaz.yml",{"template":1794},"BlogAuthor",{"name":7,"config":1796},{"headshot":1797,"ctfId":1798},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659556/Blog/Author%20Headshots/fern_diaz.png","fjdiaz","yml",{},"/en-us/blog/authors/fernando-diaz",{},"en-us/blog/authors/fernando-diaz","lxRJIOydP4_yzYZvsPcuQevP9AYAKREF7i8QmmdnOWc",[1806,1814,1822],{"title":1807,"description":1808,"heroImage":1809,"category":1092,"date":1810,"authors":1811,"slug":1813,"externalUrl":1096},"How GitLab tracks vulnerabilities through refactors and reformatting","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png","2026-08-12",[1812],"Julian Thome","improved-scope-offset-fingerprinting",{"title":1815,"description":1816,"heroImage":1809,"category":1092,"date":1817,"authors":1818,"slug":1821,"externalUrl":1096},"GitLab Secrets Manager adds ESO, Terraform, API support","Simplify credential management across your stack. GitLab Secrets Manager provides secure retrieval in Kubernetes, Terraform, and external workflows.","2026-08-06",[1819,1820],"Erick Bajao","Joe Randazzo","gitlab-secrets-manager-add-eso-terraform-api-support",{"title":1823,"description":1824,"heroImage":1825,"category":1092,"date":1826,"authors":1827,"slug":1829,"externalUrl":1096},"Secure every commit to production with Claude and GitLab","Claude Security catches vulnerabilities inside a coding session. GitLab picks up from there, scanning, enforcing policy, and producing audit evidence for the software lifecycle. ","https://res.cloudinary.com/about-gitlab-com/image/upload/v1756122536/akivvcnafog9c4dhhzkp.png","2026-08-03",[1828],"Alisa Ho","claude-security-and-gitlab",{"promotions":1831},[1832,1846,1858,1869],{"id":1833,"categories":1834,"header":1836,"text":1837,"button":1838,"image":1843},"ai-modernization",[1835],"ai","Is AI achieving its promise at scale?","Quiz will take 5 minutes or less",{"text":1839,"config":1840},"Get your AI maturity score",{"href":1841,"dataGaName":1842,"dataGaLocation":1318},"/assessments/ai-modernization-assessment/","modernization assessment",{"config":1844},{"src":1845},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/qix0m7kwnd8x2fh1zq49.png",{"id":1847,"categories":1848,"header":1850,"text":1837,"button":1851,"image":1855},"devops-modernization",[1849,1655],"product","Are you just managing tools or shipping innovation?",{"text":1852,"config":1853},"Get your DevOps maturity score",{"href":1854,"dataGaName":1842,"dataGaLocation":1318},"/assessments/devops-modernization-assessment/",{"config":1856},{"src":1857},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138785/eg818fmakweyuznttgid.png",{"id":1859,"categories":1860,"header":1861,"text":1837,"button":1862,"image":1866},"security-modernization",[1092],"Are you trading speed for security?",{"text":1863,"config":1864},"Get your security maturity score",{"href":1865,"dataGaName":1842,"dataGaLocation":1318},"/assessments/security-modernization-assessment/",{"config":1867},{"src":1868},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1772138786/p4pbqd9nnjejg5ds6mdk.png",{"id":1870,"paths":1871,"header":1874,"text":1875,"button":1876,"image":1881},"github-azure-migration",[1872,1873],"migration-from-azure-devops-to-gitlab","integrating-azure-devops-scm-and-gitlab","Is your team ready for GitHub's Azure move?","GitHub is already rebuilding around Azure. Find out what it means for you.",{"text":1877,"config":1878},"See how GitLab compares to GitHub",{"href":1879,"dataGaName":1880,"dataGaLocation":1318},"/compare/gitlab-vs-github/github-azure-migration/","github azure migration",{"config":1882},{"src":1857},{"header":1884,"blurb":1885,"button":1886,"secondaryButton":1891},"Start building faster today","See what your team can do with the intelligent orchestration platform for DevSecOps.\n",{"text":1887,"config":1888},"Get your free trial",{"href":1889,"dataGaName":1119,"dataGaLocation":1890},"https://gitlab.com/-/trial_registrations/new?glm_content=default-saas-trial&glm_source=about.gitlab.com/","feature",{"text":1591,"config":1892},{"href":1443,"dataGaName":1124,"dataGaLocation":1890},1786803737392]