GitLab: Security, Container Registry & Environments

GitLab Security Scanning

GitLab Ultimate includes a full suite of security scanners that run as CI jobs and report findings in the MR Security tab.

# Enable all security scans by including GitLab templates
include:
  - template: Security/SAST.gitlab-ci.yml
  - template: Security/Dependency-Scanning.gitlab-ci.yml
  - template: Security/Container-Scanning.gitlab-ci.yml
  - template: Security/DAST.gitlab-ci.yml
  - template: Security/Secret-Detection.gitlab-ci.yml

Security Scanner Types

• SAST (Static Application Security Testing): analyze source code for vulnerabilities (SQL injection, XSS, etc.)

• Dependency Scanning: detect vulnerable packages in package.json, Gemfile, requirements.txt, etc.

• Container Scanning: scan Docker images for CVEs using Trivy or Grype

• DAST (Dynamic Application Security Testing): run against a live URL — finds runtime vulnerabilities

• Secret Detection: scan commits for accidentally committed secrets (API keys, tokens)

• Coverage-guided fuzzing: run AI-powered fuzz testing against your functions

• License Compliance: detect licenses in dependencies — block unapproved licenses

Vulnerability Dashboard

• Security → Vulnerability Report: all detected vulnerabilities per project

• Status: Detected → Confirmed → Resolved (or Dismissed with reason)

• Dismiss: mark as "Not a problem", "Used in tests", "Mitigating control" with comment

• Create issue from vulnerability: one-click issue creation with full context

• Security policies: enforce scan thresholds — fail MR if new critical CVE detected

Container Registry

# GitLab provides a built-in container registry per project

# Login
docker login registry.gitlab.com

# Build and push
docker build -t registry.gitlab.com/group/project:latest .
docker push registry.gitlab.com/group/project:latest

# In CI/CD — use predefined variables
build_image:
  image: docker:24
  services:
    - docker:24-dind
  script:
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA

Registry Management

• Cleanup policies: auto-delete old images by tag pattern and age (Settings → Packages & Registries)

• Protected tags: prevent deletion of specific tags (e.g., latest, v*)

• Pull-through cache: proxy requests to Docker Hub or other registries through GitLab

• Dependency proxy: cache frequently used upstream images (node:20, alpine) in your group

CI/CD Secrets & Variables

# Stored in Settings → CI/CD → Variables
# Types:
#   Variable — plain text
#   File — written to a temp file, $VAR_NAME = path to file

# Protect variables: only exposed to protected branches/tags
# Mask variables: hidden from job logs

# Access in .gitlab-ci.yml
deploy:
  script:
    - echo "$DATABASE_URL"        # direct use
    - cat "$SERVICE_ACCOUNT_JSON" # file-type variable

Access Tokens & OAuth

• Personal Access Tokens: Settings → Access Tokens — scopes: api, read_api, read_user, write_repository

• Project Access Tokens: scoped to a single project — use for CI bots

• Group Access Tokens: scoped to a group and all its subgroups/projects

• Deploy tokens: limited token for pulling container images or packages in deployment

• OAuth applications: register an app to use GitLab as an OAuth provider

• Token expiry: enforce expiry dates, rotate regularly