diff options
| author | Ben Bodenmiller <bbodenmiller@hotmail.com> | 2017-09-06 05:56:11 +0000 |
|---|---|---|
| committer | Ben Bodenmiller <bbodenmiller@hotmail.com> | 2017-09-06 05:56:11 +0000 |
| commit | a13402da2555292f33f22993b840e60b3f260e66 (patch) | |
| tree | eb1c2bbea10ca2802b4a2b11119a2ee6740d7cb1 /doc/ci/runners | |
| parent | d68ff7f50a93ebbff537b5e795cf6bf80bd66a6e (diff) | |
| download | gitlab-ce-a13402da2555292f33f22993b840e60b3f260e66.tar.gz | |
clarify that only some Runner Executors have these security concerns
Diffstat (limited to 'doc/ci/runners')
| -rw-r--r-- | doc/ci/runners/README.md | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/doc/ci/runners/README.md b/doc/ci/runners/README.md index f5d3b524d6e..bac8e972754 100644 --- a/doc/ci/runners/README.md +++ b/doc/ci/runners/README.md @@ -228,7 +228,8 @@ To make a Runner pick tagged/untagged jobs: ### Be careful with sensitive information -If you can run a job on a Runner, you can get access to any code it runs +With some [Runner Executors](https://docs.gitlab.com/runner/executors/README.html), +if you can run a job on the Runner, you can get access to any code it runs and get the token of the Runner. With shared Runners, this means that anyone that runs jobs on the Runner, can access anyone else's code that runs on the Runner. @@ -237,7 +238,8 @@ In addition, because you can get access to the Runner token, it is possible to create a clone of a Runner and submit false jobs, for example. The above is easily avoided by restricting the usage of shared Runners -on large public GitLab instances and controlling access to your GitLab instance. +on large public GitLab instances, controlling access to your GitLab instance, +and using more secure [Runner Executors](https://docs.gitlab.com/runner/executors/README.html). ### Forks |