CODEWITHSUNDEEP
dockergitlabgitlab-ci-runner
aborted
aborted

Reputation: 4541

Docker and Gitlab - how to modify the docker run

I'm very new to contentious integration with Docker and Gitlab.

I have a situation where my script in .gitlab-ci.yml needs to encode files with ioncube, but that's now fully possible due to some security restrictions that Docker has placed. Therefore, I need to modify the docker run command that Gitlab runs when I start a job for my Gitlab project.

According to this page...

In addition, a change to the Docker security options on the container will be required to allow for the licensing process to function by using the –security-opt seccomp:unconfined option to the docker run command.

I need to adding that extra parameter to the docker run call, but since Gitlab does that somewhere, I have no idea how to proceed.

Is there a way I can get Gitlab to include –security-opt seccomp:unconfined when I run a job?

EDIT: I host Gitlab on my own server.

Upvotes: 2

Views: 2117

Answers (1)

disflux
disflux

Reputation: 439

The GitLab CI Process executes it's Pipeline stages/builds via a GitLab Runner. (https://docs.gitlab.com/runner/).

The GitLab Runner is registered to a GitLab instance or a specific GitLab Project. The configuration that you specify in the gitlab-ci.yml file is what gets executed by the Runner. In your case, you're specifying the GitLab Runner to execute a Docker container.

There is some advanced configuration that you can do with the GitLab Runners (https://docs.gitlab.com/runner/configuration/advanced-configuration.html). The setting that you are looking for is in this section: https://docs.gitlab.com/runner/configuration/advanced-configuration.html#the-runners-docker-section.

On the server that is hosting your GitLab Runner (or in the Docker instance that is hosting your GitLab Runner) modify the config.toml file (probably at /etc/gitlab-runner/config.toml). You should see a [runners.docker] section if you've registered this Runner to execute Docker containers. It is in this section that you want to add in:

security_opt: ["seccomp:unconfined"]

Upvotes: 7

Related Questions