gitlab实践--使用gitlab runner构建docker镜像

1、使用Docker安装并配置GitLab

安装

# 运行GitLab容器
docker run -d \
  -p 80:80 \
  -p 2222:22 \
  -p 443:443 \
  -p 5005:5005 \
  -v /docker/gitlab/config:/etc/gitlab \
  -v /docker/gitlab/data:/var/opt/gitlab \
  -v /docker/gitlab/logs:/var/log/gitlab \
  --restart always \
  --name gitlab \
  swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/gitlab/gitlab-ce:latest

查看GitLab初始密码

• 查看用户root的密码

docker exec -it gitlab grep "Password:" /etc/gitlab/initial_root_password

配置GitLab

cat /docker/gitlab/config/gitlab.rb  | grep -v "^$" | grep -v "#"

# 端口号不是80的要添加
external_url 'http://192.168.137.11'

# gitlab模式不开启registry，使用以下配置开启
registry_external_url 'http://192.168.137.11:5005'
gitlab_rails['registry_enabled'] = true
nginx['listen_https'] = false
registry_nginx['listen_port'] = 5005
registry_nginx['listen_https'] = false

# 重新加载gitlab的配置，重启registry服务。在容器中执行
gitlab_ctl reconfigure
gitlab-ctl restart registry

2、安装配置gitlab-runner

安装

docker run -d \
--name gitlab-runner \
--restart always \
--privileged \
-v /var/run/docker.sock:/var/run/docker.sock \
-v /docker/gitlab-runner-config:/etc/gitlab-runner \
swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/gitlab/gitlab-runner:v18.0.2

注册runner

方式一：registration token（注册令牌）正在被废弃

• 在容器中执行,生成runner的配置文件/etc/gitlab-runner/config.toml
• gitlab--管理员--CI/CD--runner--token

# 注册runner
gitlab-runner register

Enter the GitLab instance URL: http://192.168.137.11
Enter the registration token: dNxF5tNeyx1KdmryR4Bw
Enter a description for the runner: docker runner
Enter tags for the runner: docker
Enter optional maintenance note for the runner: docker runner
Enter an executor：docker
Enter the default Docker image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/docker:latest

config.toml

cat /docker/gitlab-runner-config/config.toml
concurrent = 1
check_interval = 0
connection_max_age = "15m0s"
shutdown_timeout = 0

[session_server]
  session_timeout = 1800

[[runners]]
  name = "runner3"
  url = "http://192.168.137.11"
  id = 3
  token = "glrtr-ahS8Vd4yKmBa_3mp_GAv"
  token_obtained_at = 2026-03-29T06:47:31Z
  token_expires_at = 0001-01-01T00:00:00Z
  executor = "docker"
  [runners.cache]
    MaxUploadedArchiveSize = 0
    [runners.cache.s3]
    [runners.cache.gcs]
    [runners.cache.azure]
  [runners.docker]
    tls_verify = false
    image = "swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/docker:latest"
    privileged = true
    disable_entrypoint_overwrite = false
    oom_kill_disable = false
    disable_cache = false
    volumes = ["/cache", "/var/run/docker.sock:/var/run/docker.sock"]
    shm_size = 0
    network_mtu = 0

runner镜像的选择

• .gitlab-ci.yml的镜像值会覆盖gitlab-runner register中指- 定的镜像
• 专业的做法是在不同构建阶段使用不同的镜像
  • 通用/测试：alpine:latest
  • 构建 Docker 镜像：docker:latest
  • K8s / kubectl 部署：bitnami/kubectl:latest
  • 写代码：golang:1.22 / openjdk:17 / node:20

方式二：authentication token（认证令牌）

3、自动构建docker镜像

• 从gitlab容器仓库拉取镜像，修改dockerfile后将其提交到项目仓库，自动触发构建，将新的镜像推送到容器仓库

适配http

• 因为关闭了https，docker login 默认是https，需要信任这个仓库，才能docker login成功

cat <<EOF> /etc/docker/daemon.json
{
  "insecure-registries": ["192.168.137.11:5005"]
}
EOF

准备测试镜像

# docker仓库用来验证身份，是否有push权限
docker login 192.168.137.11:5005
# 下载测试镜像
docker pull swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/nginx:alpine
# 打上标签，格式为要提交到的仓库路径
docker tag  swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/nginx:alpine  192.168.137.11:5005/mygroup/docker-project/nginx:alpine
# 提交到仓库
docker push 192.168.137.11:5005/mygroup/docker-project/nginx:alpine

准备项目文件

• 创建项目目录

mkdir -p /demo/docker-demo

• Dockerfile

FROM  192.168.137.11:5005/mygroup/docker-project/nginx:alpine
RUN echo "Hello Docker Build in GitLab CI 1" > /usr/share/nginx/html/index.html

• .gitlab-ci.yml

stages:
  - docker-build

docker-build:
  stage: docker-build
  tags:
    - docker
  image: swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/docker:latest
  services:
    - swr.cn-north-4.myhuaweicloud.com/ddn-k8s/docker.io/library/docker:dind
  script:
    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
    - docker build -t $CI_REGISTRY_IMAGE:latest .
    - docker push $CI_REGISTRY_IMAGE:latest

添加变量

• gitlab--管理员--设置--CI/CD--变量
• 变量

CI_REGISTRY             192.168.137.11:5005
CI_REGISTRY_IMAGE       192.168.137.11:5005/mygroup/docker-project/my-nginx
CI_REGISTRY_PASSWORD    123456
CI_REGISTRY_USER        root

git 相关配置

• 添加密钥对

ssh-keygen -t ed25519 -C "你的邮箱"  # 创建密钥对并添加标记，便于识别
cat ~/.ssh/id_ed25519.pub           # 复制公钥内容，粘贴到gitlab的SSH密钥配置里

• 指定提交者信息

git config --global user.email "admin@11.com"
git config --global user.name "clx"

• 配置本地仓库环境

git init
git add .
git commit -m "first commit"  # 提交到本地版本库，必须写提交信息
git remote add origin http://192.168.40.15/mygroup/dockerproject.git

• 推送文件到仓库

git pull origin main --rebase     # 先拉再推，避免报错：不能覆盖远程仓库
git branch -M main                # 切换到master分支
git push -u origin main:dev       # 建立上游分支，下次直接git push。分支冲突会创建新分支DEV
git remote set-url origin newaddr # 更换新的提交仓库