Skip to content

ci(registry): build/scan/promote 16 images to GitLab registry (sign in phase 2)

Jérôme Revillard requested to merge ci/gitlab-registry-build-scan into main

What

Publishes all 16 custom images to the GitLab Container Registry on every MR / main commit / tag, scanned with GitLab's official Container Scanning template. Replaces the local frontend-only rebuild with a full build → scan → promote pipeline.

Architecture (final)

build:image   →  tmp/<image>:<candidat>     (docker buildx native, registry cache backend)
container_scanning  →  GitLab official template (advisory, security dashboard + CycloneDX SBOM)
[e2e on merge trains — pulls tmp/ candidate]
promote:image →  tmp/<image>@digest → <image>:main / :vX.Y.Z / :latest   (main/tags only)
  • tmp/ quarantine namespace: candidates isolated from the deployable namespace. Orphans reaped by GitLab native cleanup policy.
  • Cross-repo promote by digest: the exact bytes scanned are the bytes deployed.
  • docker buildx native (docker-container driver) — required disabling userns-remap on the runner daemon (proven impossible with userns-remap, see ADR).
  • GitLab official Container Scanning — correct-schema report + MR widget + security dashboard. Blocking on HIGH/CRITICAL via MR approval rule (follow-up).

Runner changes (deploy/ansible)

  • docker_userns_remap: false — disabled (incompatible with buildkit, see ADR conflict table)
  • docker_socket_proxy AUTH + DISTRIBUTION enabled (registry login/push)
  • gitlab_runner udev handler fix (command → shell for &&)
  • isolation retained via socket proxy (API filtering) + dedicated runner VM

Files

  • .gitlab-ci.yml — build:image (matrix 16), container_scanning (template override), promote:image, e2e pulls from tmp/
  • docs/adr/0001-gitlab-registry-build-scan-pipeline.md — full architecture + decisions
  • deploy/ansible/roles/docker_socket_proxy/ — AUTH + DISTRIBUTION
  • deploy/ansible/roles/docker/ — daemon.json clear when userns off
  • deploy/ansible/roles/gitlab_runner/ — udev handler fix
  • deploy/ansible/group_vars/gitlab_runners/vars.yml — userns off

Verification

  • glab ci lint valid
  • build:image 16/16 green (docker buildx native)
  • container_scanning 16/16 green (GitLab template)
  • full pipeline green on this MR
  • registry populated under tmp/ (MR candidates) — promote runs on main/tag only

Follow-ups (separate MRs)

  1. Security-testing suite — SAST, Dependency Scanning, Secret Detection, IaC Scanning (GitLab Ultimate templates)
  2. CVE triage — populate vulnerability-allowlist.yml from dashboard findings
  3. MR approval rule — block merge on HIGH/CRITICAL container scanning findings (project setting)
  4. Phase 2 — cosign signing + ansible pulls from GitLab registry + cosign verify at deploy
  5. Phase 3 — retire the local Swarm registry

See docs/adr/0001-gitlab-registry-build-scan-pipeline.md for the full rationale (userns-remap × buildkit conflict, tmp/ namespace, signing deferral).

Edited by Jérôme Revillard

Merge request reports