Sign inSign up

ravermeister/ci-runner

By ravermeister

•Updated 2 days ago

Mutliple CI-Runner in a Docker Container

Image
Integration & delivery
Developer tools
1

7.1K

ravermeister/ci-runner repository overview

⁠Multiple CI Runner in Docker

This Container includes multiple CI Runners.
The Source Code can be found here⁠.

⁠System Requirements

⁠Software included

⁠Runner/Agent
⁠tools
  • docker-ce-cli
  • docker-buildx
  • git
  • git-lfs

See also the versions.env⁠ for the Software.

⁠How to run

Before starting, you have to configure a runner:

⁠configure forgejo-runner

before using this image you have to generate a config.yml

wget -qO docker-compose.yml https://gitlab.rimkus.it/development/ci-runner/-/raw/main/docker-compose.yml?ref_type=heads
docker-compose pull
docker-compose run -it --entrypoint ci-runner forgejo generate-config>config.yml
touch runner.cfg
docker-compose run -v $(pwd)/runner.cfg:/root/.runner -it --entrypoint ci-runner forgejo register

you can use the docker-compose⁠ as an example of how to run this image.

⁠configure woodpecker-agent

If you only want to start a single agent, use the WOODPECKER_* Environment Variables to configure the agent. See the Docker Compose⁠

If you want several agents running within one Container:
create a config directory for woodpecker and add a file named *.agent for each agent. Add the WOODPECKER_* Variables into the file

WOODPECKER_SERVER=woodpecker-grpc.codeberg.org
WOODPECKER_AGENT_SECRET=XXXXXXXXXXXXXXXXX
WOODPECKER_GRPC_SECURE=true
WOODPECKER_HEALTHCHECK=false
WOODPECKER_BACKEND=docker
WOODPECKER_HOSTNAME=woodpecker
WOODPECKER_AGENT_LABELS=owner=raver
WOODPECKER_MAX_WORKFLOWS=2

mount the config Directory into /etc/woodpecker e.g.:

  woodpecker:
    image: docker.io/ravermeister/ci-runner
    hostname: woodpecker
    restart: unless-stopped
    networks:
      - ci-bridge-net
    depends_on:
      docker:
        condition: service_healthy
    environment:
      CI_RUNNER: woodpecker
      DOCKER_HOST: tcp://docker:2375
    volumes:
      - /etc/ci-runner/woodpecker:/etc/woodpecker
⁠configure gitlab-runner

See the general Documentation⁠ how to Register a runner. Prefix the given command with the container from docker-compose:

wget -qO docker-compose.yml https://gitlab.rimkus.it/development/ci-runner/-/raw/main/docker-compose.yml?ref_type=heads
docker-compose pull
mkdir gitlab && touch gitlab/config.toml
docker-compose run -it -v $(pwd)/gitlab:/etc/gitlab-runner --entrypoint gitlab-runner gitlab register

⁠Deny Access to LAN for the Container

To further harden the Isolation, the docker-compose⁠ File uses a separate bridge Network with a pre-defined name ci-bridge-net, you can verify this with the ip a command. You should see a new Network device called ci-bridge-net. Now you can add an IPTable rule⁠, to deny Access to the LAN.

iptables -I FORWARD -i ci-bridge-net -d 192.168.0.0/16 -j DROP
ip6tables -I FORWARD -i ci-bridge-net -d 2a02:8464:7240:a2b0::/64 -j DROP
# persist the ip table rules
iptables-save >/etc/iptables/rules.v4
ip6tables-save >/etc/iptables/rules.v6

Tag summary

Content type

Image

Digest

sha256:077c93f22…

Size

222.2 MB

Last updated

2 days ago

docker pull ravermeister/ci-runner:woodpecker-3.16.0