Running gitlab-ci pipeline jobs as non-root user

Question

I have a mvn project which must be build as an non-root user but by default gitlab-ci allows runners to run as root user. I'm using gitlab.com runners by setting up gitlab-ci.yml file. I tried creating a user and switching to it like this:

$ useradd ***
$ su -***
$ whoami
root

It still says I'm root. How can I solve this?

See here: https://stackoverflow.com/questions/37187899/change-gitlab-ci-runner-user/40703269#40703269 — Alexander, Feb 28 '18 at 19:47
@Alexander that does not solve , running non root user in the pipeline but rather deals with setting up non-root user in gitlab-ci runner — Jimmy Obonyo Abor, Apr 04 '18 at 19:46

score 4 · Answer 1 · answered Jan 20 '19 at 18:42

You can easily achieve this with sudo, e.g., excerpt from my .gitlab-ci.yml:

script:
    - useradd -d /builds/{GITLAB_USER} -g users -M -N builder
    - chown -R builder:users ..
    - |     
      sudo -H -i -u builder sh -e -x << EOS                                                                                                                                                                                                                       
      umask 0077                                                                                                                                                                                                                                               
      export CONTINUOUS_INTEGRATION_SYSTEM="gitlab" TIMESTAMP=`date +%Y%m%d%H%M%S` DEFAULT_TARGET="debug"                                                                                                                                                      
      export PREFIX="\${HOME}/usr" SYSCONFDIR="\${HOME}/etc/conf" LOCALSTATEDIR="\${HOME}/var"                                                                                                                                                                 
      cd my-project                                                                                                                                                                                                                                                  
      make install                                                                                                                                                                                                                                             
      make -C _deploy/debian clean package bundle BUILD_ID="-0{other}\${TIMESTAMP}"                                                                                                                                                                        
      EOS

Where {GITLAB_USER} is your actual gitlab user. Remember to escape $ in your script

In GitLab 10.0 and above, you can use `${GITLAB_USER_LOGIN}` instead of doing the username substitution manually - this makes it work across forks. You may also wish to replace the actual project name with `${CI_PROJECT_NAME}` (note you should not escape _this_ `$`), which makes it work across even forks that adopt a different project name. — Robin Green, Mar 01 '20 at 22:14
Do note that you might want to quote `EOS` as `'EOS'` as per [How to avoid heredoc expanding variables?](https://stackoverflow.com/questions/27920806/how-to-avoid-heredoc-expanding-variables), to avoid potentially confusing issues with variable expansion. — detly, May 24 '21 at 01:53
Tip: If you want to preserve the env use `--preserve-env=PATH` for using the same PATH. This is handy if you wanted to do a `sudo --preserve-env=PATH sh < EOS mvn build EOS` instead of a `sudo env "PATH=$PATH" mvn build` — dmachop, Jul 13 '22 at 18:53

score 0 · Answer 2 · edited Apr 06 '18 at 04:32

0

Just install the gitlab-runner service for the right user:

gitlab-runner install --working-directory /home/ubuntu --user ubuntu

Here, ubuntu is an arbitrary non-root user.

edited Apr 06 '18 at 04:32

Hermann Döppes

1,373
1
18
26

answered Apr 05 '18 at 20:34

Alexander

25
3

Incorrect Usage: flag provided but not defined: -user – Julien Baldy May 17 '22 at 08:28

score 0 · Answer 3 · answered May 04 '23 at 08:52

0


sudo gitlab-runner install --working-directory /home/username --user username

You need to be root to install with the --user flag so you can run gitlab-runner as an unprivileged user.

answered May 04 '23 at 08:52

Polarimetric

1
2

score -1 · Answer 4 · edited Apr 05 '18 at 21:06

-1

There are several ways to accomplish this. Since gitlab-ci jobs are simply docker containers running processes, one way to achieve this would be to use gosu where you can run a process as a non-root user. Some links which show how to use gosu:

edited Apr 05 '18 at 21:06

Hermann Döppes

1,373
1
18
26

answered Apr 04 '18 at 20:40

Jimmy Obonyo Abor

7,335
10
43
71

Running gitlab-ci pipeline jobs as non-root user

4 Answers4