diff --git a/.gitlab/merge_request_templates/new_feature.md b/.gitlab/merge_request_templates/new_feature.md index 74abae94c94dc0768bb5c51fe51ad253fce113fe..491b7f98ded7e0da03d18c95978eafcb7d86619f 100644 --- a/.gitlab/merge_request_templates/new_feature.md +++ b/.gitlab/merge_request_templates/new_feature.md @@ -8,8 +8,8 @@ Closes #999 ## Checklist * General: - * [ ] use [rules](https://docs.gitlab.com/ee/ci/yaml/#rules) instead of [only/except](https://docs.gitlab.com/ee/ci/yaml/#onlyexcept-advanced) - * [ ] optimized [cache](https://docs.gitlab.com/ee/ci/caching/) configuration (wherever applicable) + * [ ] use [rules](https://docs.gitlab.com/ci/yaml/#rules) instead of [only/except](https://docs.gitlab.com/ci/yaml/#onlyexcept-advanced) + * [ ] optimized [cache](https://docs.gitlab.com/ci/caching/) configuration (wherever applicable) * Publicly usable: * [ ] untagged runners * [ ] no proxy configuration but support `http_proxy`/`https_proxy`/`no_proxy` diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index dda66dec1e96ab19b4b8078d86841fe78e48e66b..532cd7f04dd719c3520d047170cfd4cf4ff4b486 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -61,7 +61,7 @@ To contribute: 1. Create an issue describing the bug or enhancement you want to propose (select the right issue template). 2. Make sure the issue has been reviewed and agreed. -3. Create a Merge Request, from your **own** fork (see [forking workflow](https://docs.gitlab.com/ee/user/project/repository/forking_workflow.html) documentation). +3. Create a Merge Request, from your **own** fork (see [forking workflow](https://docs.gitlab.com/user/project/repository/forking_workflow/) documentation). Don't hesitate to mark your MR as `Draft` as long as you think it's not ready to be reviewed. ### Git Commit Conventions diff --git a/README.md b/README.md index bd3798c51bfdc54952beec9ccf98360c4335fb36..de539caab2a4379f46b3add629f0d7908aa2f7ec 100644 --- a/README.md +++ b/README.md @@ -6,8 +6,8 @@ It supports [kaniko](https://github.com/GoogleContainerTools/kaniko), [Buildah]( ## Usage -This template can be used both as a [CI/CD component](https://docs.gitlab.com/ee/ci/components/#use-a-component) -or using the legacy [`include:project`](https://docs.gitlab.com/ee/ci/yaml/index.html#includeproject) syntax. +This template can be used both as a [CI/CD component](https://docs.gitlab.com/ci/components/#use-a-component) +or using the legacy [`include:project`](https://docs.gitlab.com/ci/yaml/#includeproject) syntax. ### Use as a CI/CD component @@ -49,10 +49,10 @@ The template supports following ways of building container images: 3. Or using [buildah](https://buildah.io/), an open-source, daemonless tool backed by RedHat for building Docker images, and that solves Docker-in-Docker security issues (and also speeds-up build times), and can also be configured to run rootless. -By default, the template uses the [kaniko](https://docs.gitlab.com/ee/ci/docker/using_kaniko.html) way, but you may +By default, the template uses the [kaniko](https://docs.gitlab.com/ci/docker/using_kaniko.html) way, but you may select an alternate build tool by using the `DOCKER_BUILD_TOOL` variable (see below). -:warning: If you choose to use 'Docker-in-Docker' option considering the associated security risks, make sure your runner has required privileges to run Docker-in-Docker ([see GitLab doc](https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#use-docker-in-docker-workflow-with-docker-executor)). +:warning: If you choose to use 'Docker-in-Docker' option considering the associated security risks, make sure your runner has required privileges to run Docker-in-Docker ([see GitLab doc](https://docs.gitlab.com/ci/docker/using_docker_build.html#use-docker-in-docker-workflow-with-docker-executor)). ### Global variables @@ -160,7 +160,7 @@ There might be cases where you need to provide the complete [Docker configuratio If you are in one of those cases, you will need to use the `DOCKER_CONFIG_FILE` variable, expected to declare the path to your custom Docker configuration file (JSON). You may: - leave the default value (`.docker/config.json`) or override it to some alternate location in your project repository and create the file **without any secret in it** using our dynamic variables replacement (see below), -- or override it as a GitLab project variable of type [File](https://docs.gitlab.com/ee/ci/variables/#cicd-variable-types), possibly inlining your secret credentials in it. +- or override it as a GitLab project variable of type [File](https://docs.gitlab.com/ci/variables/#cicd-variable-types), possibly inlining your secret credentials in it. | Input / Variable | Description | Default value | | ------------------------------------ | -------------------------------------------- | --------------------- | @@ -201,7 +201,7 @@ This file uses: - template-managed `${docker_snapshot_authent_token}`, `${docker_snapshot_registry_host}`, `${docker_release_authent_token}` and `${docker_release_registry_host}` variables, - the user-defined `${MY_OWN_REGISTRY_TOKEN}` (:information_source: an authentication token can be obtained with command `echo "user:password" | base64` and then be stored as a masked GitLab CI/CD project variable). -Example 2: Docker configuration file declared as a GitLab project variable of type [File](https://docs.gitlab.com/ee/ci/variables/#cicd-variable-types) with **dynamic variables replacement**: +Example 2: Docker configuration file declared as a GitLab project variable of type [File](https://docs.gitlab.com/ci/variables/#cicd-variable-types) with **dynamic variables replacement**: ```json { @@ -221,14 +221,14 @@ Example 2: Docker configuration file declared as a GitLab project variable of ty This file uses: -- template-managed `${docker_snapshot_authent_token}`, `${docker_snapshot_registry_host}`, `${docker_release_authent_token}` and `${docker_release_registry_host}` variables (:warning: mind the double `$$` to prevent GitLab from [trying to evaluate the variable](https://docs.gitlab.com/ee/ci/variables/index.html#use-the--character-in-variables)), +- template-managed `${docker_snapshot_authent_token}`, `${docker_snapshot_registry_host}`, `${docker_release_authent_token}` and `${docker_release_registry_host}` variables (:warning: mind the double `$$` to prevent GitLab from [trying to evaluate the variable](https://docs.gitlab.com/ci/variables/#use-the--character-in-variables)), - the user-defined authentication may be inlined as a GitLab project variable is a place safe enough to store secrets. ## Multi Dockerfile support This template supports building multiple Docker images from a single Git repository. -You can define the images to build using the [parallel matrix jobs](https://docs.gitlab.com/ee/ci/yaml/#parallel-matrix-jobs) +You can define the images to build using the [parallel matrix jobs](https://docs.gitlab.com/ci/yaml/#parallel-matrix-jobs) pattern inside the `.docker-base` job (this is the top parent job of all Docker template jobs). Since each job in the template extends this base job, the pipeline will produce one job instance per image to build. @@ -262,12 +262,12 @@ variables: Here are some advices about your **secrets** (variables marked with a :lock:): -1. Manage them as [project or group CI/CD variables](https://docs.gitlab.com/ee/ci/variables/#for-a-project): - - [**masked**](https://docs.gitlab.com/ee/ci/variables/#mask-a-cicd-variable) to prevent them from being inadvertently +1. Manage them as [project or group CI/CD variables](https://docs.gitlab.com/ci/variables/#for-a-project): + - [**masked**](https://docs.gitlab.com/ci/variables/#mask-a-cicd-variable) to prevent them from being inadvertently displayed in your job logs, - - [**protected**](https://docs.gitlab.com/ee/ci/variables/#protected-cicd-variables) if you want to secure some secrets + - [**protected**](https://docs.gitlab.com/ci/variables/#protected-cicd-variables) if you want to secure some secrets you don't want everyone in the project to have access to (for instance production secrets). -2. In case a secret contains [characters that prevent it from being masked](https://docs.gitlab.com/ee/ci/variables/#mask-a-cicd-variable), +2. In case a secret contains [characters that prevent it from being masked](https://docs.gitlab.com/ci/variables/#mask-a-cicd-variable), simply define its value as the [Base64](https://en.wikipedia.org/wiki/Base64) encoded value prefixed with `@b64@`: it will then be possible to mask it and the template will automatically decode it prior to using it. 3. Don't forget to escape special characters (ex: `$` -> `$$`). @@ -303,7 +303,7 @@ In addition to a textual report in the console, this job produces the following | Report | Format | Usage | | -------------------------------------------- | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `reports/docker-hadolint-*.native.json` | native hadolint test report (json) | [DefectDojo integration](https://docs.defectdojo.com/en/connecting_your_tools/parsers/file/hadolint/)<br/>_This report is generated only if DefectDojo template is detected_ | -| `reports/docker-hadolint-*.codeclimate.json` | hadolint (GitLab) codeclimate format | [GitLab integration](https://docs.gitlab.com/ee/ci/yaml/artifacts_reports.html#artifactsreportscodequality) | +| `reports/docker-hadolint-*.codeclimate.json` | hadolint (GitLab) codeclimate format | [GitLab integration](https://docs.gitlab.com/ci/yaml/artifacts_reports/#artifactsreportscodequality) | ### `docker-*-build` jobs @@ -323,7 +323,7 @@ It is bound to the `package-build` stage, and uses the following variables: | `build-cache-disabled` / `DOCKER_BUILD_CACHE_DISABLED` | Set to `true` to disable the build cache.<br/>Cache can typically be disabled when there is a network latency between the container registry and the runner. | _none_ (i.e cache enabled) | | `push-args` / `DOCKER_PUSH_ARGS` | Additional `push` arguments for [docker](https://docs.docker.com/reference/cli/docker/image/push/) or [buildah](https://github.com/containers/buildah/blob/main/docs/buildah-push.1.md) (executed right after `build`).<br>Ex: `--compression-format zstd --compression-level 20` | _(none)_ | -This job produces _output variables_ that are propagated to downstream jobs (using [dotenv artifacts](https://docs.gitlab.com/ee/ci/yaml/artifacts_reports.html#artifactsreportsdotenv)): +This job produces _output variables_ that are propagated to downstream jobs (using [dotenv artifacts](https://docs.gitlab.com/ci/yaml/artifacts_reports/#artifactsreportsdotenv)): | Input / Variable | Description | Example | | --------------------- | ------------------------------------------------------ | -------------------------------------------------------------- | @@ -354,7 +354,7 @@ LABEL name="my-project" \ maintainer="my-project@acme.com" ``` -Default value for `DOCKER_METADATA` supports a subset of the [OCI Image Format Specification](https://github.com/opencontainers/image-spec/blob/master/annotations.md) for labels and use [GitLab CI pre-defined variables](https://docs.gitlab.com/ee/ci/variables/predefined_variables.html) to guess the value as follow : +Default value for `DOCKER_METADATA` supports a subset of the [OCI Image Format Specification](https://github.com/opencontainers/image-spec/blob/master/annotations.md) for labels and use [GitLab CI pre-defined variables](https://docs.gitlab.com/ci/variables/predefined_variables/) to guess the value as follow : | Label | GitLab CI pre-defined variable | | ----------------------------------- | ------------------------------ | @@ -392,7 +392,7 @@ If you have defined one of those labels in the Dockerfile, the final value will ### `docker-healthcheck` job -:warning: this job requires that your runner has required privileges to run [Docker-in-Docker](https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#use-docker-in-docker-workflow-with-docker-executor). +:warning: this job requires that your runner has required privileges to run [Docker-in-Docker](https://docs.gitlab.com/ci/docker/using_docker_build.html#use-docker-in-docker-workflow-with-docker-executor). If it is not the case this job will not be run. This job performs a [Health Check](https://docs.docker.com/engine/reference/builder/#healthcheck) on your built image. @@ -445,7 +445,7 @@ In addition to a textual report in the console, this job produces the following | Report | Format | Usage | | ------------------------------------ | ------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `reports/docker-trivy-*.native.json` | native Trivy report format (json) | [DefectDojo integration](https://docs.defectdojo.com/en/connecting_your_tools/parsers/file/trivy/)<br/>_This report is generated only if DefectDojo template is detected_ | -| `reports/docker-trivy-*.gitlab.json` | [Trivy report format for GitLab](https://aquasecurity.github.io/trivy/latest/tutorials/integrations/gitlab-ci/) format | [GitLab integration](https://docs.gitlab.com/ee/ci/yaml/artifacts_reports.html#artifactsreportscontainer_scanning) | +| `reports/docker-trivy-*.gitlab.json` | [Trivy report format for GitLab](https://aquasecurity.github.io/trivy/latest/tutorials/integrations/gitlab-ci/) format | [GitLab integration](https://docs.gitlab.com/ci/yaml/artifacts_reports/#artifactsreportscontainer_scanning) | ### `docker-sbom` job @@ -473,7 +473,7 @@ This job pushes (_promotes_) the built image as the _release_ image [skopeo](htt | `release-extra-tags` / `DOCKER_RELEASE_EXTRA_TAGS` | Defines extra tags to publish the _release_ image (supports capturing group references from `$DOCKER_RELEASE_EXTRA_TAGS_PATTERN` - [see below](#using-extra-tags)) | _(none)_ | | `semrel-release-disabled` / `DOCKER_SEMREL_RELEASE_DISABLED` | Set to `true` to disable [semantic-release integration](#semantic-release-integration) | _none_ (enabled) | -This job produces _output variables_ that are propagated to downstream jobs (using [dotenv artifacts](https://docs.gitlab.com/ee/ci/yaml/artifacts_reports.html#artifactsreportsdotenv)): +This job produces _output variables_ that are propagated to downstream jobs (using [dotenv artifacts](https://docs.gitlab.com/ci/yaml/artifacts_reports/#artifactsreportsdotenv)): | Input / Variable | Description | Example | | --------------------- | ----------------------------------------------------- | ----------------------------------------------------- | @@ -576,7 +576,7 @@ Depending on the Docker registry you're using, you may have to use a real passwo ### Building multiple Docker images -Here is a `.gitlab-ci.yaml` that builds 2 Docker images from the same project (uses [parallel matrix jobs](https://docs.gitlab.com/ee/ci/yaml/#parallel-matrix-jobs)): +Here is a `.gitlab-ci.yaml` that builds 2 Docker images from the same project (uses [parallel matrix jobs](https://docs.gitlab.com/ci/yaml/#parallel-matrix-jobs)): ```yaml include: @@ -613,7 +613,7 @@ In order to be able to communicate with the Vault server, the variant requires t | :lock: `VAULT_ROLE_ID` | The [AppRole](https://www.vaultproject.io/docs/auth/approle) RoleID | _none_ | | :lock: `VAULT_SECRET_ID` | The [AppRole](https://www.vaultproject.io/docs/auth/approle) SecretID | _none_ | -By default, the variant will authentifacte using a [JWT ID token](https://docs.gitlab.com/ee/ci/secrets/id_token_authentication.html). To use [AppRole](https://www.vaultproject.io/docs/auth/approle) instead the `VAULT_ROLE_ID` and `VAULT_SECRET_ID` should be defined as secret project variables. +By default, the variant will authentifacte using a [JWT ID token](https://docs.gitlab.com/ci/secrets/id_token_authentication/). To use [AppRole](https://www.vaultproject.io/docs/auth/approle) instead the `VAULT_ROLE_ID` and `VAULT_SECRET_ID` should be defined as secret project variables. #### Usage @@ -669,7 +669,7 @@ List of requirements before using this variant for publishing your container ima | ----------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------- | | `TBC_GCP_PROVIDER_IMAGE` | The [GCP Auth Provider](https://gitlab.com/to-be-continuous/tools/gcp-auth-provider) image to use (can be overridden) | `registry.gitlab.com/to-be-continuous/tools/gcp-auth-provider:latest` | | `gcp-oidc-aud` / `GCP_OIDC_AUD` | The `aud` claim for the JWT token | `$CI_SERVER_URL` | -| `gcp-oidc-provider` / `GCP_OIDC_PROVIDER` | Default Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/) | _none_ | +| `gcp-oidc-provider` / `GCP_OIDC_PROVIDER` | Default Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/) | _none_ | | `gcp-oidc-account` / `GCP_OIDC_ACCOUNT` | Default Service Account to which impersonate with OpenID Connect authentication | _none_ | | `gcp-snapshot-oidc-provider` / `GCP_SNAPSHOT_OIDC_PROVIDER` | Workload Identity Provider to push the snapshot image _(only define to override default)_ | _none_ | | `gcp-snapshot-oidc-account` / `GCP_SNAPSHOT_OIDC_ACCOUNT` | Service Account to use to push the snapshot image _(only define to override default)_ | _none_ | @@ -712,7 +712,7 @@ that will be used as a temporary credential to login to the ECR registry. In order to use the AWS APIs, the variant supports two authentication methods: -1. [federated authentication using OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/aws/) (**recommended method**), +1. [federated authentication using OpenID Connect](https://docs.gitlab.com/ci/cloud_services/aws/) (**recommended method**), 2. or basic authentication with AWS access key ID & secret access key. :warning: when using this variant, you must have created the ECR repositories to push the snapshot and/or the release images. @@ -731,7 +731,7 @@ to use the snapshot image repository (will host your snapshot image as well as c ##### OIDC authentication config -This is the recommended authentication method. In order to use it, first carefuly follow [GitLab's documentation](https://docs.gitlab.com/ee/ci/cloud_services/aws/), +This is the recommended authentication method. In order to use it, first carefuly follow [GitLab's documentation](https://docs.gitlab.com/ci/cloud_services/aws/), then set the required configuration. | Input / Variable | Description | Default value | diff --git a/kicker.json b/kicker.json index 7bc910f35b2dd6cdc125cddb1265712c9c11ce17..cae82169db1ed881c805fc989ac19aa9f3da87c4 100644 --- a/kicker.json +++ b/kicker.json @@ -269,7 +269,7 @@ }, { "name": "GCP_OIDC_AUD", - "description": "The `aud` claim for the JWT token _(only required for [OIDC authentication](https://docs.gitlab.com/ee/ci/cloud_services/aws/))_", + "description": "The `aud` claim for the JWT token _(only required for [OIDC authentication](https://docs.gitlab.com/ci/cloud_services/aws/))_", "default": "$CI_SERVER_URL", "advanced": true }, @@ -279,7 +279,7 @@ }, { "name": "GCP_OIDC_PROVIDER", - "description": "Default Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/)" + "description": "Default Workload Identity Provider associated with GitLab to [authenticate with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/)" }, { "name": "GCP_SNAPSHOT_OIDC_ACCOUNT", @@ -331,22 +331,22 @@ }, { "name": "AWS_OIDC_AUD", - "description": "The `aud` claim for the JWT token _(only required for [OIDC authentication](https://docs.gitlab.com/ee/ci/cloud_services/aws/))_", + "description": "The `aud` claim for the JWT token _(only required for [OIDC authentication](https://docs.gitlab.com/ci/cloud_services/aws/))_", "default": "$CI_SERVER_URL", "advanced": true }, { "name": "AWS_OIDC_ROLE_ARN", - "description": "Default IAM Role ARN associated with GitLab _(only required for [OIDC authentication](https://docs.gitlab.com/ee/ci/cloud_services/aws/))_" + "description": "Default IAM Role ARN associated with GitLab _(only required for [OIDC authentication](https://docs.gitlab.com/ci/cloud_services/aws/))_" }, { "name": "AWS_SNAPSHOT_OIDC_ROLE_ARN", - "description": "IAM Role ARN associated with GitLab for the snapshot image _(only required for [OIDC authentication](https://docs.gitlab.com/ee/ci/cloud_services/aws/) and if different from default)_", + "description": "IAM Role ARN associated with GitLab for the snapshot image _(only required for [OIDC authentication](https://docs.gitlab.com/ci/cloud_services/aws/) and if different from default)_", "advanced": true }, { "name": "AWS_RELEASE_OIDC_ROLE_ARN", - "description": "IAM Role ARN associated with GitLab for the release image _(only required for [OIDC authentication](https://docs.gitlab.com/ee/ci/cloud_services/aws/) and if different from default)_", + "description": "IAM Role ARN associated with GitLab for the release image _(only required for [OIDC authentication](https://docs.gitlab.com/ci/cloud_services/aws/) and if different from default)_", "advanced": true }, { diff --git a/templates/gitlab-ci-docker-ecr.yml b/templates/gitlab-ci-docker-ecr.yml index df6d3db9f594106761264e111a9c3b0316e73907..5c9b9de831888c8ebfde7e2f317016d4052716c5 100644 --- a/templates/gitlab-ci-docker-ecr.yml +++ b/templates/gitlab-ci-docker-ecr.yml @@ -15,20 +15,20 @@ spec: different from default)_ default: '' aws-oidc-aud: - description: The `aud` claim for the JWT token _(only required for [OIDC authentication](https://docs.gitlab.com/ee/ci/cloud_services/aws/))_ + description: The `aud` claim for the JWT token _(only required for [OIDC authentication](https://docs.gitlab.com/ci/cloud_services/aws/))_ default: $CI_SERVER_URL aws-oidc-role-arn: description: Default IAM Role ARN associated with GitLab _(only required for [OIDC - authentication](https://docs.gitlab.com/ee/ci/cloud_services/aws/))_ + authentication](https://docs.gitlab.com/ci/cloud_services/aws/))_ default: '' aws-snapshot-oidc-role-arn: description: IAM Role ARN associated with GitLab for the snapshot image _(only - required for [OIDC authentication](https://docs.gitlab.com/ee/ci/cloud_services/aws/) + required for [OIDC authentication](https://docs.gitlab.com/ci/cloud_services/aws/) and if different from default)_ default: '' aws-release-oidc-role-arn: description: IAM Role ARN associated with GitLab for the release image _(only - required for [OIDC authentication](https://docs.gitlab.com/ee/ci/cloud_services/aws/) + required for [OIDC authentication](https://docs.gitlab.com/ci/cloud_services/aws/) and if different from default)_ default: '' --- diff --git a/templates/gitlab-ci-docker-gcp.yml b/templates/gitlab-ci-docker-gcp.yml index 667884f784b2d940cc8924eeddf111eaa6a42f88..4d729a936da9d5a5f827974bba380508fd9bdd14 100644 --- a/templates/gitlab-ci-docker-gcp.yml +++ b/templates/gitlab-ci-docker-gcp.yml @@ -4,7 +4,7 @@ spec: inputs: gcp-oidc-aud: - description: The `aud` claim for the JWT token _(only required for [OIDC authentication](https://docs.gitlab.com/ee/ci/cloud_services/aws/))_ + description: The `aud` claim for the JWT token _(only required for [OIDC authentication](https://docs.gitlab.com/ci/cloud_services/aws/))_ default: $CI_SERVER_URL gcp-oidc-account: description: Default Service Account to which impersonate with OpenID Connect @@ -12,7 +12,7 @@ spec: default: '' gcp-oidc-provider: description: Default Workload Identity Provider associated with GitLab to [authenticate - with OpenID Connect](https://docs.gitlab.com/ee/ci/cloud_services/google_cloud/) + with OpenID Connect](https://docs.gitlab.com/ci/cloud_services/google_cloud/) default: '' gcp-snapshot-oidc-account: description: Service Account to use to push the snapshot image _(only define if diff --git a/templates/gitlab-ci-docker.yml b/templates/gitlab-ci-docker.yml index 31f6ad824bc0f01f53d1659752fc89f0ca287ad0..b5dafe2d4b85a5e04cc46632a7e0c8bfabbbf8b2 100644 --- a/templates/gitlab-ci-docker.yml +++ b/templates/gitlab-ci-docker.yml @@ -786,7 +786,7 @@ stages: extends: .docker-base image: $DOCKER_IMAGE variables: - # disable TLS between Docker client and Docker daemon : https://docs.gitlab.com/ee/ci/docker/using_docker_build.html#tls-disabled + # disable TLS between Docker client and Docker daemon : https://docs.gitlab.com/ci/docker/using_docker_build.html#tls-disabled DOCKER_HOST: tcp://docker:2375 DOCKER_TLS_CERTDIR: "" # make visible DEFAULT_CA_CERTS and CUSTOM_CA_CERTS variables to the service (we MUST use different variable names)