README.md 16,7 КБ
Newer Older
Marcia Ramos's avatar
Marcia Ramos включено в состав коммита
1
2
3
4
---
type: reference
---

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
5
# Configuring GitLab Runners
Douwe Maan's avatar
Douwe Maan включено в состав коммита
6

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
7
8
9
In GitLab CI, Runners run the code defined in [`.gitlab-ci.yml`](../yaml/README.md).
They are isolated (virtual) machines that pick up jobs through the coordinator
API of GitLab CI.
Douwe Maan's avatar
Douwe Maan включено в состав коммита
10

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
11
12
A Runner can be specific to a certain project or serve any project
in GitLab CI. A Runner that serves all projects is called a shared Runner.
Douwe Maan's avatar
Douwe Maan включено в состав коммита
13

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
14
Ideally, the GitLab Runner should not be installed on the same machine as GitLab.
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
15
Read the [requirements documentation](../../install/requirements.md#gitlab-runner)
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
16
17
for more information.

Dylan Griffith's avatar
Dylan Griffith включено в состав коммита
18
## Shared, specific and group Runners
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

After [installing the Runner][install], you can either register it as shared or
specific. You can only register a shared Runner if you have admin access to
the GitLab instance. The main differences between a shared and a specific Runner
are:

- **Shared Runners** are useful for jobs that have similar requirements,
  between multiple projects. Rather than having multiple Runners idling for
  many projects, you can have a single or a small number of Runners that handle
  multiple projects. This makes it easier to maintain and update them.
  Shared Runners process jobs using a [fair usage queue](#how-shared-runners-pick-jobs).
  In contrast to specific Runners that use a FIFO queue, this prevents
  cases where projects create hundreds of jobs which can lead to eating all
  available shared Runners resources.
- **Specific Runners** are useful for jobs that have special requirements or for
  projects with a specific demand. If a job has certain requirements, you can set
  up the specific Runner with this in mind, while not having to do this for all
Marcel Amirault's avatar
Marcel Amirault включено в состав коммита
36
  Runners. For example, if you want to deploy a certain project, you can set up
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
37
38
  a specific Runner to have the right credentials for this. The [usage of tags](#using-tags)
  may be useful in this case. Specific Runners process jobs using a [FIFO] queue.
Dylan Griffith's avatar
Dylan Griffith включено в состав коммита
39
- **Group Runners** are useful when you have multiple projects under one group
Dylan Griffith's avatar
Dylan Griffith включено в состав коммита
40
  and would like all projects to have access to a set of Runners. Group Runners
Dylan Griffith's avatar
Dylan Griffith включено в состав коммита
41
  process jobs using a [FIFO] queue.
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
42
43
44

A Runner that is specific only runs for the specified project(s). A shared Runner
can run jobs for every project that has enabled the option **Allow shared Runners**
Aric Buerer's avatar
Aric Buerer включено в состав коммита
45
under **Settings > CI/CD**.
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
46
47
48
49

Projects with high demand of CI activity can also benefit from using specific
Runners. By having dedicated Runners you are guaranteed that the Runner is not
being held up by another project's jobs.
Douwe Maan's avatar
Douwe Maan включено в состав коммита
50

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
51
52
53
You can set up a specific Runner to be used by multiple projects. The difference
with a shared Runner is that you have to enable each project explicitly for
the Runner to be able to run its jobs.
Douwe Maan's avatar
Douwe Maan включено в состав коммита
54

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
55
Specific Runners do not get shared with forked projects automatically.
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
56
57
A fork does copy the CI settings (jobs, allow shared, etc) of the cloned
repository.
Douwe Maan's avatar
Douwe Maan включено в состав коммита
58

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
59
## Registering a shared Runner
Douwe Maan's avatar
Douwe Maan включено в состав коммита
60

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
61
You can only register a shared Runner if you are an admin of the GitLab instance.
Douwe Maan's avatar
Douwe Maan включено в состав коммита
62

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
63
1. Grab the shared-Runner token on the `admin/runners` page
Douwe Maan's avatar
Douwe Maan включено в состав коммита
64

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
65
    ![Shared Runners admin area](img/shared_runners_admin.png)
Douwe Maan's avatar
Douwe Maan включено в состав коммита
66

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
67
1. [Register the Runner][register]
Douwe Maan's avatar
Douwe Maan включено в состав коммита
68

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
69
70
Shared Runners are enabled by default as of GitLab 8.2, but can be disabled
with the **Disable shared Runners** button which is present under each project's
bikebilly's avatar
bikebilly включено в состав коммита
71
**Settings ➔ CI/CD** page. Previous versions of GitLab defaulted shared
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
72
Runners to disabled.
Douwe Maan's avatar
Douwe Maan включено в состав коммита
73

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
74
## Registering a specific Runner
Douwe Maan's avatar
Douwe Maan включено в состав коммита
75

Dylan Griffith's avatar
Dylan Griffith включено в состав коммита
76
Registering a specific Runner can be done in two ways:
Douwe Maan's avatar
Douwe Maan включено в состав коммита
77

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
78
79
1. Creating a Runner with the project registration token
1. Converting a shared Runner into a specific Runner (one-way, admin only)
Douwe Maan's avatar
Douwe Maan включено в состав коммита
80

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
81
### Registering a specific Runner with a project registration token
Douwe Maan's avatar
Douwe Maan включено в состав коммита
82

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
83
To create a specific Runner without having admin rights to the GitLab instance,
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
84
visit the project you want to make the Runner work for in GitLab:
Douwe Maan's avatar
Douwe Maan включено в состав коммита
85

Aric Buerer's avatar
Aric Buerer включено в состав коммита
86
1. Go to **Settings > CI/CD** to obtain the token
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
87
1. [Register the Runner][register]
Douwe Maan's avatar
Douwe Maan включено в состав коммита
88

Dylan Griffith's avatar
Dylan Griffith включено в состав коммита
89
90
## Registering a group Runner

Mark Chao's avatar
Mark Chao включено в состав коммита
91
Creating a group Runner requires Maintainer permissions for the group. To create a
Dylan Griffith's avatar
Dylan Griffith включено в состав коммита
92
93
94
95
96
group Runner visit the group you want to make the Runner work for in GitLab:

1. Go to **Settings > CI/CD** to obtain the token
1. [Register the Runner][register]

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
97
### Making an existing shared Runner specific
Douwe Maan's avatar
Douwe Maan включено в состав коммита
98

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
99
100
101
If you are an admin on your GitLab instance, you can turn any shared Runner into
a specific one, but not the other way around. Keep in mind that this is a one
way transition.
Douwe Maan's avatar
Douwe Maan включено в состав коммита
102

Aric Buerer's avatar
Aric Buerer включено в состав коммита
103
1. Go to the Runners in the admin area **Overview > Runners** (`/admin/runners`)
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
104
105
106
   and find your Runner
1. Enable any projects under **Restrict projects for this Runner** to be used
   with the Runner
Douwe Maan's avatar
Douwe Maan включено в состав коммита
107

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
108
109
110
From now on, the shared Runner will be specific to those projects.

## Locking a specific Runner from being enabled for other projects
Lin Jen-Shin's avatar
Lin Jen-Shin включено в состав коммита
111

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
112
113
You can configure a Runner to assign it exclusively to a project. When a
Runner is locked this way, it can no longer be enabled for other projects.
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
114
115
116
117
118
This setting can be enabled the first time you [register a Runner][register] and
can be changed afterwards under each Runner's settings.

To lock/unlock a Runner:

Aric Buerer's avatar
Aric Buerer включено в состав коммита
119
1. Visit your project's **Settings > CI/CD**
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
120
121
122
123
1. Find the Runner you wish to lock/unlock and make sure it's enabled
1. Click the pencil button
1. Check the **Lock to current projects** option
1. Click **Save changes** for the changes to take effect
Lin Jen-Shin's avatar
Lin Jen-Shin включено в состав коммита
124

Fabio Busatto's avatar
Fabio Busatto включено в состав коммита
125
126
## Assigning a Runner to another project

Mark Chao's avatar
Mark Chao включено в состав коммита
127
If you are Maintainer on a project where a specific Runner is assigned to, and the
Fabio Busatto's avatar
Fabio Busatto включено в состав коммита
128
Runner is not [locked only to that project](#locking-a-specific-runner-from-being-enabled-for-other-projects),
Mark Chao's avatar
Mark Chao включено в состав коммита
129
you can enable the Runner also on any other project where you have Maintainer permissions.
Fabio Busatto's avatar
Fabio Busatto включено в состав коммита
130
131
132

To enable/disable a Runner in your project:

Aric Buerer's avatar
Aric Buerer включено в состав коммита
133
1. Visit your project's **Settings > CI/CD**
Fabio Busatto's avatar
Fabio Busatto включено в состав коммита
134
135
136
137
138
1. Find the Runner you wish to enable/disable
1. Click **Enable for this project** or **Disable for this project**

> **Note**:
Consider that if you don't lock your specific Runner to a specific project, any
Mark Chao's avatar
Mark Chao включено в состав коммита
139
user with Maintainer role in you project can assign your Runner to another arbitrary
Fabio Busatto's avatar
Fabio Busatto включено в состав коммита
140
141
project without requiring your authorization, so use it with caution.

Matija Čupić's avatar
Matija Čupić включено в состав коммита
142
143
144
145
146
147
148
149
CAUTION: **Caution:**
Never add a private Runner that you're using in your private projects to a
project that you share with other people.

CAUTION: **Caution:**
Never use a Runner from a project which has multiple maintainers in your
private project.

Aric Buerer's avatar
Aric Buerer включено в состав коммита
150
151
152
An admin can enable/disable a specific Runner for projects:

1. Navigate to **Admin > Runners**
Evan Read's avatar
Evan Read включено в состав коммита
153
154
155
1. Find the Runner you wish to enable/disable
1. Click edit on the Runner
1. Click **Enable** or **Disable** on the project
Aric Buerer's avatar
Aric Buerer включено в состав коммита
156

Shinya Maeda's avatar
Fix doc    
Shinya Maeda включено в состав коммита
157
## Protected Runners
Shinya Maeda's avatar
Add doc    
Shinya Maeda включено в состав коммита
158

Brett Walker's avatar
Brett Walker включено в состав коммита
159
160
> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/13194)
> in GitLab 10.0.
Shinya Maeda's avatar
Add doc    
Shinya Maeda включено в состав коммита
161

Shinya Maeda's avatar
Fix doc    
Shinya Maeda включено в состав коммита
162
163
164
You can protect Runners from revealing sensitive information.
Whenever a Runner is protected, the Runner picks only jobs created on
[protected branches] or [protected tags], and ignores other jobs.
Shinya Maeda's avatar
Add doc    
Shinya Maeda включено в состав коммита
165

Shinya Maeda's avatar
Fix doc    
Shinya Maeda включено в состав коммита
166
To protect/unprotect Runners:
Shinya Maeda's avatar
Add doc    
Shinya Maeda включено в состав коммита
167

Aric Buerer's avatar
Aric Buerer включено в состав коммита
168
1. Visit your project's **Settings > CI/CD**
Shinya Maeda's avatar
Fix doc    
Shinya Maeda включено в состав коммита
169
170
1. Find a Runner you want to protect/unprotect and make sure it's enabled
1. Click the pencil button besides the Runner name
Shinya Maeda's avatar
Add doc    
Shinya Maeda включено в состав коммита
171
172
173
1. Check the **Protected** option
1. Click **Save changes** for the changes to take effect

Shinya Maeda's avatar
Fix doc    
Shinya Maeda включено в состав коммита
174
![specific Runners edit icon](img/protected_runners_check_box.png)
Shinya Maeda's avatar
Fix doc    
Shinya Maeda включено в состав коммита
175

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
176
177
## Manually clearing the Runners cache

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
178
Read [clearing the cache](../caching/index.md#clearing-the-cache).
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
179

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
180
## How shared Runners pick jobs
Douwe Maan's avatar
Douwe Maan включено в состав коммита
181

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
182
183
184
Shared Runners abide to a process queue we call fair usage. The fair usage
algorithm tries to assign jobs to shared Runners from projects that have the
lowest number of jobs currently running on shared Runners.
Douwe Maan's avatar
Douwe Maan включено в состав коммита
185

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
186
**Example 1**
Douwe Maan's avatar
Douwe Maan включено в состав коммита
187

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
188
We have following jobs in queue:
Douwe Maan's avatar
Douwe Maan включено в состав коммита
189

Joe Marty's avatar
Joe Marty включено в состав коммита
190
191
192
193
194
195
- Job 1 for Project 1
- Job 2 for Project 1
- Job 3 for Project 1
- Job 4 for Project 2
- Job 5 for Project 2
- Job 6 for Project 3
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
196
197
198

With the fair usage algorithm jobs are assigned in following order:

Joe Marty's avatar
Joe Marty включено в состав коммита
199
200
201
202
203
204
1. Job 1 is chosen first, because it has the lowest job number from projects with no running jobs (i.e. all projects)
1. Job 4 is next, because 4 is now the lowest job number from projects with no running jobs (Project 1 has a job running)
1. Job 6 is next, because 6 is now the lowest job number from projects with no running jobs (Projects 1 and 2 have jobs running)
1. Job 2 is next, because, of projects with the lowest number of jobs running (each has 1), it is the lowest job number
1. Job 5 is next, because Project 1 now has 2 jobs running, and between Projects 2 and 3, Job 5 is the lowest remaining job number
1. Lastly we choose Job 3... because it's the only job left
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
205
206
207
208
209
210
211

---

**Example 2**

We have following jobs in queue:

Joe Marty's avatar
Joe Marty включено в состав коммита
212
213
214
215
216
217
- Job 1 for project 1
- Job 2 for project 1
- Job 3 for project 1
- Job 4 for project 2
- Job 5 for project 2
- Job 6 for project 3
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
218
219
220

With the fair usage algorithm jobs are assigned in following order:

Joe Marty's avatar
Joe Marty включено в состав коммита
221
1. Job 1 is chosen first, because it has the lowest job number from projects with no running jobs (i.e. all projects)
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
222
1. We finish job 1
Joe Marty's avatar
Joe Marty включено в состав коммита
223
224
1. Job 2 is next, because, having finished Job 1, all projects have 0 jobs running again, and 2 is the lowest available job number
1. Job 4 is next, because with Project 1 running a job, 4 is the lowest number from projects running no jobs (Projects 2 and 3)
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
225
1. We finish job 4
Joe Marty's avatar
Joe Marty включено в состав коммита
226
227
228
1. Job 5 is next, because having finished Job 4, Project 2 has no jobs running again
1. Job 6 is next, because Project 3 is the only project left with no running jobs
1. Lastly we choose Job 3... because, again, it's the only job left (who says 1 is the loneliest number?)
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
229
230

## Using shared Runners effectively
Douwe Maan's avatar
Douwe Maan включено в состав коммита
231

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
232
If you are planning to use shared Runners, there are several things you
Douwe Maan's avatar
Douwe Maan включено в состав коммита
233
234
should keep in mind.

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
235
### Using tags
Douwe Maan's avatar
Douwe Maan включено в состав коммита
236

Marcel Amirault's avatar
Marcel Amirault включено в состав коммита
237
You must set up a Runner to be able to run all the different types of jobs
Douwe Maan's avatar
Douwe Maan включено в состав коммита
238
239
240
241
that it may encounter on the projects it's shared over. This would be
problematic for large amounts of projects, if it wasn't for tags.

By tagging a Runner for the types of jobs it can handle, you can make sure
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
242
shared Runners will [only run the jobs they are equipped to run](../yaml/README.md#tags).
Douwe Maan's avatar
Douwe Maan включено в состав коммита
243

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
244
For instance, at GitLab we have Runners tagged with "rails" if they contain
Douwe Maan's avatar
Douwe Maan включено в состав коммита
245
246
the appropriate dependencies to run Rails test suites.

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
247
### Allowing Runners with tags to pick jobs without tags
Grzegorz Bizon's avatar
Grzegorz Bizon включено в состав коммита
248

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
249
250
When you [register a Runner][register], its default behavior is to **only pick**
[tagged jobs](../yaml/README.md#tags).
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
251

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
252
253
254
NOTE: **Note:**
Maintainer [permissions](../../user/permissions.md) are required to change the
Runner settings.
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
255

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
To make a Runner pick untagged jobs:

1. Visit your project's **Settings > CI/CD > Runners**.
1. Find the Runner you want to pick untagged jobs and make sure it's enabled.
1. Click the pencil button.
1. Check the **Run untagged jobs** option.
1. Click the **Save changes** button for the changes to take effect.

NOTE: **Note:**
The Runner tags list can not be empty when it's not allowed to pick untagged jobs.

Below are some example scenarios of different variations.

#### Runner runs only tagged jobs

The following examples illustrate the potential impact of the Runner being set
to run only tagged jobs.

Example 1:

1. The Runner is configured to run only tagged jobs and has the `docker` tag.
1. A job that has a `hello` tag is executed and stuck.

Example 2:

1. The Runner is configured to run only tagged jobs and has the `docker` tag.
1. A job that has a `docker` tag is executed and run.

Example 3:

1. The Runner is configured to run only tagged jobs and has the `docker` tag.
1. A job that has no tags defined is executed and stuck.

#### Runner is allowed to run untagged jobs

The following examples illustrate the potential impact of the Runner being set
to run tagged and untagged jobs.

Example 1:

1. The Runner is configured to run untagged jobs and has the `docker` tag.
1. A job that has no tags defined is executed and run.
1. A second job that has a `docker` tag defined is executed and run.

Example 2:

1. The Runner is configured to run untagged jobs and has no tags defined.
1. A job that has no tags defined is executed and run.
1. A second job that has a `docker` tag defined is stuck.
Grzegorz Bizon's avatar
Grzegorz Bizon включено в состав коммита
305

Tomasz Maczukin's avatar
Tomasz Maczukin включено в состав коммита
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
### Setting maximum job timeout for a Runner

For each Runner you can specify a _maximum job timeout_. Such timeout,
if smaller than [project defined timeout], will take the precedence. This
feature can be used to prevent Shared Runner from being appropriated
by a project by setting a ridiculous big timeout (e.g. one week).

When not configured, Runner will not override project timeout.

How this feature will work:

**Example 1 - Runner timeout bigger than project timeout**

1. You set the _maximum job timeout_ for a Runner to 24 hours
1. You set the _CI/CD Timeout_ for a project to **2 hours**
1. You start a job
1. The job, if running longer, will be timeouted after **2 hours**

**Example 2 - Runner timeout not configured**

1. You remove the _maximum job timeout_ configuration from a Runner
1. You set the _CI/CD Timeout_ for a project to **2 hours**
1. You start a job
1. The job, if running longer, will be timeouted after **2 hours**

**Example 3 - Runner timeout smaller than project timeout**

1. You set the _maximum job timeout_ for a Runner to **30 minutes**
1. You set the _CI/CD Timeout_ for a project to 2 hours
1. You start a job
1. The job, if running longer, will be timeouted after **30 minutes**

Grzegorz Bizon's avatar
Grzegorz Bizon включено в состав коммита
338
### Be careful with sensitive information
Douwe Maan's avatar
Douwe Maan включено в состав коммита
339

Ben Bodenmiller's avatar
Ben Bodenmiller включено в состав коммита
340
341
With some [Runner Executors](https://docs.gitlab.com/runner/executors/README.html),
if you can run a job on the Runner, you can get access to any code it runs
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
342
and get the token of the Runner. With shared Runners, this means that anyone
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
343
344
that runs jobs on the Runner, can access anyone else's code that runs on the
Runner.
Douwe Maan's avatar
Douwe Maan включено в состав коммита
345

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
346
347
In addition, because you can get access to the Runner token, it is possible
to create a clone of a Runner and submit false jobs, for example.
Douwe Maan's avatar
Douwe Maan включено в состав коммита
348

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
349
The above is easily avoided by restricting the usage of shared Runners
Ben Bodenmiller's avatar
Ben Bodenmiller включено в состав коммита
350
351
on large public GitLab instances, controlling access to your GitLab instance,
and using more secure [Runner Executors](https://docs.gitlab.com/runner/executors/README.html).
Douwe Maan's avatar
Douwe Maan включено в состав коммита
352
353
354
355

### Forks

Whenever a project is forked, it copies the settings of the jobs that relate
Marcel Amirault's avatar
Marcel Amirault включено в состав коммита
356
to it. This means that if you have shared Runners set up for a project and
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
357
someone forks that project, the shared Runners will also serve jobs of this
Douwe Maan's avatar
Douwe Maan включено в состав коммита
358
359
project.

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
360
## Attack vectors in Runners
Douwe Maan's avatar
Douwe Maan включено в состав коммита
361

Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
362
363
364
Mentioned briefly earlier, but the following things of Runners can be exploited.
We're always looking for contributions that can mitigate these
[Security Considerations](https://docs.gitlab.com/runner/security/).
Achilleas Pipinellis's avatar
Achilleas Pipinellis включено в состав коммита
365

Tomasz Maczukin's avatar
Tomasz Maczukin включено в состав коммита
366
367
368
369
### Resetting the registration token for a Project

If you think that registration token for a Project was revealed, you should
reset them. It's recommended because such token can be used to register another
Alex's avatar
Alex включено в состав коммита
370
Runner to the Project. It may be next used to obtain the values of secret
Tomasz Maczukin's avatar
Tomasz Maczukin включено в состав коммита
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
variables or clone the project code, that normally may be unavailable for the
attacker.

To reset the token:

1. Go to **Settings > CI/CD** for a specified Project
1. Expand the **General pipelines settings** section
1. Find the **Runner token** form field and click the **Reveal value** button
1. Delete the value and save the form
1. After the page is refreshed, expand the **Runners settings** section
    and check the registration token - it should be changed

From now on the old token is not valid anymore and will not allow to register
a new Runner to the project. If you are using any tools to provision and
register new Runners, you should now update the token that is used to the
new value.

Dylan Griffith's avatar
Dylan Griffith включено в состав коммита
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
## Determining the IP address of a Runner

> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/17286) in GitLab 10.6.

It may be useful to know the IP address of a Runner so you can troubleshoot
issues with that Runner. GitLab stores and displays the IP address by viewing
the source of the HTTP requests it makes to GitLab when polling for jobs. The
IP address is always kept up to date so if the Runner IP changes it will be
automatically updated in GitLab.

The IP address for shared Runners and specific Runners can be found in
different places.

### Shared Runners

To view the IP address of a shared Runner you must have admin access to
the GitLab instance. To determine this:

1. Visit **Admin area ➔ Overview ➔ Runners**
1. Look for the Runner in the table and you should see a column for "IP Address"

![shared Runner IP address](img/shared_runner_ip_address.png)

### Specific Runners

You can find the IP address of a Runner for a specific project by:

1. Visit your project's **Settings ➔ CI/CD**
1. Find the Runner and click on it's ID which links you to the details page
1. On the details page you should see a row for "IP Address"

![specific Runner IP address](img/specific_runner_ip_address.png)
Tomasz Maczukin's avatar
Tomasz Maczukin включено в состав коммита
420

Evan Read's avatar
Evan Read включено в состав коммита
421
[install]: https://docs.gitlab.com/runner/install/
Tomasz Maczukin's avatar
Tomasz Maczukin включено в состав коммита
422
[fifo]: https://en.wikipedia.org/wiki/FIFO_(computing_and_electronics)
Evan Read's avatar
Evan Read включено в состав коммита
423
[register]: https://docs.gitlab.com/runner/register/
Tomasz Maczukin's avatar
Tomasz Maczukin включено в состав коммита
424
425
426
[protected branches]: ../../user/project/protected_branches.md
[protected tags]: ../../user/project/protected_tags.md
[project defined timeout]: ../../user/project/pipelines/settings.html#timeout