Skip to content

feat(ansible): GitLab Runner deployment with Docker socket proxy

Jérôme Revillard requested to merge worktree-gitlab-runner-ansible into main

Summary

  • Extract Docker installation from monolithic deploy.yml into reusable roles/docker (backward-compatible, no behavior change)
  • Add roles/docker_socket_proxy — tecnativa/docker-socket-proxy via docker-compose (default-deny API filtering)
  • Add roles/gitlab_runner — installs gitlab-runner, deploys config.toml with security hardening (resource limits, cap_drop ALL, no privileged)
  • Simplify runner registration: manual glrt-xxx token flow instead of API-based registration (GitLab 16+ best practice)

Security

  • CI jobs access Docker through the socket proxy, not the raw socket
  • Only explicitly allowed API endpoints: CONTAINERS, IMAGES, NETWORKS, VOLUMES, EXEC, POST
  • Blocked: SWARM, SECRETS, AUTH, PLUGINS, BUILD, TASKS
  • Resource limits: 4g RAM, 2 CPUs per job
  • cap_drop: ALL, privileged: false

Test plan

  • ansible-playbook --syntax-check gitlab-runner.yml passes
  • Full deployment on 10.0.0.100 succeeds
  • Proxy responds on /_ping, can list containers
  • Runner service active, connected to GitLab
  • CI job runs through proxy with testcontainers
  • Verify deploy.yml still works unchanged (backward compat)

Merge request reports