GitLab Runner config.toml 設定とよく使う CI/CD 変数

sudo gitlab-runner register \
  --non-interactive \
  --url "https://gitlab.example.com/" \
  --token "$RUNNER_TOKEN" \
  --executor "docker" \
  --docker-image alpine:latest \
  --docker-pull-policy "if-not-present" \
  --description "docker-runner"

curl --silent --request POST --url "https://gitlab.example.com/api/v4/user/runners" \
  --data "runner_type=project_type" \
  --data "project_id=<project_id>" \
  --data "description=docker-runner" \
  --data "tag_list=docker,linux" \
  --header "PRIVATE-TOKEN: <project_access_token>"

docker run -d --name gitlab-runner --restart always \
  -v /srv/gitlab-runner/config:/etc/gitlab-runner \
  -v /var/run/docker.sock:/var/run/docker.sock \
  gitlab/gitlab-runner:latest

concurrent = 4          # 全 runner 合計の同時 job 上限。0 は不可
check_interval = 3      # GitLab に新しい job を問い合わせる間隔（秒）。default 3
log_level = "info"      # debug / info / warn / error / fatal / panic
shutdown_timeout = 30   # 強制終了までの秒数。default 30

[[runners]]
  name = "docker-runner"                 # 識別用
  url = "https://gitlab.example.com/"
  token = "glrt-REDACTED"                # authentication token（registration token ではない）
  executor = "docker"                    # shell、docker、kubernetes など
  limit = 0                              # この runner の同時 job 上限。0 は無制限
  request_concurrency = 1                # GitLab への同時 job request 数。default 1
  environment = ["TZ=Asia/Taipei"]       # job の環境変数を追加・上書き

  [runners.docker]
    image = "alpine:latest"              # job が image を指定しない場合に使用
    privileged = false                   # true にすると container 隔離が無効になる（後述）
    volumes = ["/cache"]                 # 追加 mount。docker -v と同じ書式
    pull_policy = "if-not-present"       # never / if-not-present / always。default always
    allowed_images = ["registry.example.com/*"]  # job が使える image を制限。未設定ならすべて許可
    shm_size = 0

  [runners.cache]
    Type = "s3"                          # s3 / gcs / azure
    Path = "runner-cache"                # cache URL の先頭に付く path
    Shared = true                        # runner 間で cache を共有。default false
    [runners.cache.s3]
      ServerAddress = "s3.example.com"
      BucketName = "gitlab-runner-cache"
      BucketLocation = "ap-northeast-1"
      AuthenticationType = "iam"         # iam または access-key

build-image:
  image: docker:<version>-cli          # チームで検証済みの version に置き換える
  services:
    - docker:<version>-dind
  variables:
    DOCKER_TLS_CERTDIR: "/certs"
  script:
    - docker build -t "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA" .

# auth 値を作成。printf を使い、改行を encode しない
printf "my_username:my_password" | openssl base64 -A

{
  "auths": {
    "harbor.example.com": {
      "auth": "<base64 of username:password>"
    }
  }
}

script:
  - echo "$CI_REGISTRY_PASSWORD" | docker login "$CI_REGISTRY" -u "$CI_REGISTRY_USER" --password-stdin
  - docker push "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA"

sudo gitlab-runner list        # config.toml の runner を一覧表示
sudo gitlab-runner verify      # 登録済み runner が GitLab に接続できるか確認
sudo gitlab-runner status      # service の状態。実行中なら exit code 0
sudo gitlab-runner restart     # service を停止して再起動
sudo gitlab-runner start
sudo gitlab-runner stop

# 再起動せずに config.toml を再読み込み
sudo kill -SIGHUP <main_runner_pid>

# GitLab に存在しなくなった runner を削除。config.toml を書き換える
sudo gitlab-runner verify --delete

# 名前で登録解除。同名が複数ある場合は最初の 1 つだけ削除
sudo gitlab-runner unregister --name docker-runner

# URL と token で登録解除
sudo gitlab-runner unregister --url "https://gitlab.example.com/" --token "$RUNNER_TOKEN"

# すべての runner を登録解除
sudo gitlab-runner unregister --all-runners

deploy:
  script:
    - echo "Deploy $CI_COMMIT_SHORT_SHA to $CI_ENVIRONMENT_NAME"
  environment:
    name: production
  rules:
    - if: $CI_PIPELINE_SOURCE == "schedule"   # schedule 起動の pipeline ではデプロイしない
      when: never
    - if: $CI_COMMIT_TAG                       # tag pipeline でのみデプロイ