Setting the Image Pull Policy in JH GitLab Pipeline Configuration

Are you obsessed with pipeline performance, always looking for ways to speed it up? JH GitLab 15.2 already supports configuring image pull policies! The keyword is pull_policy.

Configuring the Pull Policy

Configure pull_policy in the project’s .gitlab-ci.yml:

job2:
  script: echo "Multiple pull policies."
  image:
    name: ruby:3.0
    pull_policy: if-not-present

There are three options: always (the default, always download), if-not-present (download only when no local version exists), and never (only use locally present images, never pull).

Security Concerns

Nice feature, but I worry a bit about security. Let’s discuss.

We know a runner can cache images locally. Could this happen?

• User renfei runs a private project on a shared runner and builds a private image: renfei/blog. With the image caching policy, the private image gets cached locally by the shared runner.
• User laoliu runs his project on the shared runner, but his .gitlab-ci.yml pulls the renfei/blog image. Thanks to the local cache, laoliu now uses renfei’s private image.

If everything cached on a shared runner can be read by all users, doesn’t that create a security hole? The above is my own reasoning and worry — I haven’t run the experiment to verify. Discussion only!

In short, I recommend using local image caching only on private runners, and not relying on shared runner caching for private projects.

If a runner doesn’t support the defined pull policy, the job fails with an error along these lines:

ERROR: Job failed (system failure): the configured PullPolicies ([always]) are not allowed by AllowedPullPolicies ([never])。