Runner

Jan 1, 0001

Definition

In the context of DevSecOps and application security, a “Runner” typically refers to an agent or service that executes jobs or tasks in a continuous integration/continuous deployment (CI/CD) pipeline. Runners are responsible for executing the build, test, and deployment processes defined in the pipeline configuration. They can be hosted on-premises or in the cloud and are often configured to run in isolated environments to ensure security and consistency.

Secure Settings Example

# Example configuration for a GitLab Runner with secure settings
[[runners]]
  name = "secure-runner"
  url = "https://gitlab.example.com/"
  token = "REDACTED"
  executor = "docker"
  [runners.docker]
    tls_verify = true
    image = "alpine:latest"
    privileged = false
    disable_entrypoint_overwrite = true
    oom_kill_disable = false
    disable_cache = true
    shm_size = 0

Insecure Settings Example

# Example configuration for a GitLab Runner with insecure settings
[[runners]]
  name = "insecure-runner"
  url = "https://gitlab.example.com/"
  token = "REDACTED"
  executor = "docker"
  [runners.docker]
    tls_verify = false
    image = "alpine:latest"
    privileged = true
    disable_entrypoint_overwrite = false
    oom_kill_disable = true
    disable_cache = false
    shm_size = 1024