CODEWITHSUNDEEP
dockerdeploymentgitlab-cicontinuous-deploymentgitlab-ci-runner
Christian Steinmeyer
Christian Steinmeyer

Reputation: 954

Automate local deployment of docker containers with gitlab runner and gitlab-ci without privileged user

We have a prototype-oriented develop environment, in which many small services are being developed and deployed to our on-premise hardware. We're using GitLab to manage our code and GitLab CI / CD for continuous integration. As a next step, we also want to automate the deployment process. Unfortunately, all documentation we find uses a cloud service or kubernetes cluster as target environment. However, we want to configure our GitLab runner in a way to deploy docker containers locally. At the same time, we want to avoid using a privileged user for the runner (as our servers are so far fully maintained via Ansible / services like Portainer).

Typically, our .gitlab-ci.yml looks something like this:

stages:
  - build
  - test
  - deploy

dockerimage:
  stage: build
  # builds a docker image from the Dockerfile in the repository, and pushes it to an image registry

sometest:
  stage: test
  # uses the docker image from build stage to test the service

production:
  stage: deploy
  # should create a container from the above image on system of runner without privileged user

TL;DR How can we configure our local Gitlab Runner to locally deploy docker containers from images defined in Gitlab CI / CD without usage of privileges?

Upvotes: 0

Views: 1100

Answers (1)

Peter
Peter

Reputation: 21

The Build stage is usually the one that people use Docker in Docker (find). To not have to use the privileged user you can use the kaniko executor image in Gitlab.

Specifically you would use the kaniko debug image like this:

dockerimage:
  stage: build
  image:
    name: gcr.io/kaniko-project/executor:debug
    entrypoint: [""]
  script:
    - mkdir -p /kaniko/.docker
    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"}}}" > /kaniko/.docker/config.json
    - /kaniko/executor --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/Dockerfile --destination $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG
  rules:
    - if: $CI_COMMIT_TAG

You can find examples of how to use it in Gilab's documentation.

If you want to use that image in the deploy stage you simply need to reference the created image.

You could do something like this:

production:
  stage: deploy
  image: $CI_REGISTRY_IMAGE:$CI_COMMIT_TAG

With this method, you do not need a privileged user. But I assume this is not what you are looking to do in your deployment stage. Usually, you would just use the image you created in the container registry to deploy the container locally. The last method explained would only deploy the image in the GitLab runner.

Upvotes: 1

Related Questions