samedi 20 février 2016

What are the security risks of using Gitlab CI shared test runners?

I am trying to host a new project with Gitlab. It is a private Python project. I was able to test some initial tests with Gitlab CI.

I don't use cache while running tests,

While exploring the runner section in settings, there is a warning shown,

GitLab Runners do not offer secure isolation between projects that they do builds for. You are TRUSTING all GitLab users who can push code to project A, B or C to run shell scripts on the machine hosting runner X.

what are the security risks in using a shared test runner? Is it safe to run private projects on a shared runner? What precautions can be taken while running tests on a shared runner?

Thank you for any insight.

Aucun commentaire:

Enregistrer un commentaire