Configure GitLab running in a Docker container

  • Tier: Free, Premium, Ultimate
  • Offering: GitLab Self-Managed

This container uses the official Linux package, so you can use the unique configuration file /etc/gitlab/gitlab.rb to configure the instance.

Edit the configuration file

To access the GitLab configuration file, you can start a shell session in the context of a running container.

  1. Start the session:

    shell
    sudo docker exec -it gitlab /bin/bash

    Alternatively, you can open /etc/gitlab/gitlab.rb in an editor directly:

    shell
    sudo docker exec -it gitlab editor /etc/gitlab/gitlab.rb

  2. In your preferred text editor, open /etc/gitlab/gitlab.rb and update the following fields:

    1. Set the external_url field to a valid URL for your GitLab instance.

    2. To receive emails from GitLab, configure the SMTP settings. The GitLab Docker image doesn’t have an SMTP server pre-installed.

    3. If desired enable HTTPS.

  3. Save the file and restart the container to reconfigure GitLab:

    shell
    sudo docker restart gitlab

GitLab reconfigures itself each time the container starts. For more configuration options in GitLab, see the configuration documentation.

Custom user and group IDs

By default, Docker installations ignore the uid and gid settings in gitlab.rb, such as user['uid'] or postgresql['gid']. The Docker image creates its service users and groups with fixed IDs when the image is built, and gitlab-ctl reconfigure doesn’t change them. For the IDs the image uses, see the Docker setup script.

If you need to customize service UIDs or GIDs, use a Linux package installation and follow the instructions to specify numeric user and group identifiers.

Pre-configure Docker container

You can pre-configure the GitLab Docker image by adding the environment variable GITLAB_OMNIBUS_CONFIG to the Docker run command. This variable can contain any gitlab.rb setting and is evaluated before the loading of the container’s gitlab.rb file. This behavior allows you to configure the external GitLab URL, database configuration, or any other option from the Linux package template. The settings contained in GITLAB_OMNIBUS_CONFIG aren’t written to the gitlab.rb configuration file, and are evaluated on load. To provide multiple settings, separate them with a semicolon (;).

The following example sets the external URL, enables LFS, and starts the container with a minimal shm size required for Prometheus:

shell
sudo docker run --detach \
  --hostname gitlab.example.com \
  --env GITLAB_OMNIBUS_CONFIG="external_url 'http://gitlab.example.com'; gitlab_rails['lfs_enabled'] = true;" \
  --publish 443:443 --publish 80:80 --publish 22:22 \
  --name gitlab \
  --restart always \
  --volume $GITLAB_HOME/config:/etc/gitlab \
  --volume $GITLAB_HOME/logs:/var/log/gitlab \
  --volume $GITLAB_HOME/data:/var/opt/gitlab \
  --shm-size 256m \
  gitlab/gitlab-ee:<version>-ee.0

Every time you execute a docker run command, you need to provide the GITLAB_OMNIBUS_CONFIG option. The content of GITLAB_OMNIBUS_CONFIG is not preserved between subsequent runs.

Run GitLab on a public IP address

You can make Docker use your IP address and forward all traffic to the GitLab container by modifying the --publish flag.

To expose GitLab on IP 198.51.100.1:

shell
sudo docker run --detach \
  --hostname gitlab.example.com \
  --env GITLAB_OMNIBUS_CONFIG="external_url 'http://gitlab.example.com'" \
  --publish 198.51.100.1:443:443 \
  --publish 198.51.100.1:80:80 \
  --publish 198.51.100.1:22:22 \
  --name gitlab \
  --restart always \
  --volume $GITLAB_HOME/config:/etc/gitlab \
  --volume $GITLAB_HOME/logs:/var/log/gitlab \
  --volume $GITLAB_HOME/data:/var/opt/gitlab \
  --shm-size 256m \
  gitlab/gitlab-ee:<version>-ee.0

You can then access your GitLab instance at http://198.51.100.1/ and https://198.51.100.1/.

Expose GitLab on different ports

GitLab occupies specific ports inside the container.

If you want to use different host ports from the default ports 80 (HTTP), 443 (HTTPS), or 22 (SSH), you need to add a separate --publish directive to the docker run command.

For example, to expose the web interface on the host’s port 8929, and the SSH service on port 2424:

  1. Use the following docker run command:

    shell
    sudo docker run --detach \
  --hostname gitlab.example.com \
  --env GITLAB_OMNIBUS_CONFIG="external_url 'http://gitlab.example.com:8929'; gitlab_rails['gitlab_shell_ssh_port'] = 2424" \
  --publish 8929:8929 --publish 2424:22 \
  --name gitlab \
  --restart always \
  --volume $GITLAB_HOME/config:/etc/gitlab \
  --volume $GITLAB_HOME/logs:/var/log/gitlab \
  --volume $GITLAB_HOME/data:/var/opt/gitlab \
  --shm-size 256m \
  gitlab/gitlab-ee:<version>-ee.0

    The format to publish ports is hostPort:containerPort. Read more in the Docker documentation about exposing incoming ports.

  2. Enter the running container:

    shell
    sudo docker exec -it gitlab /bin/bash

  3. Open /etc/gitlab/gitlab.rb with your editor and set external_url:

    ruby
    # For HTTP
external_url "http://gitlab.example.com:8929"

or

# For HTTPS (notice the https)
external_url "https://gitlab.example.com:8929"

    The port specified in this URL must match the port published to the host by Docker. Additionally, if the NGINX listen port is not explicitly set in nginx['listen_port'], the external_url is used instead. For more information, see the NGINX documentation.

  4. Set the SSH port:

    ruby
    gitlab_rails['gitlab_shell_ssh_port'] = 2424

  5. Finally, reconfigure GitLab:

    shell
    gitlab-ctl reconfigure

Following the previous example, your web browser can reach your GitLab instance at <hostIP>:8929 and push over SSH on port 2424.

You can see a docker-compose.yml example that uses different ports in the Docker compose section.

Customize the SSH server configuration

The GitLab Docker image runs OpenSSH with the configuration file /assets/sshd_config. This file is part of the image, so changes to it do not persist when you recreate the container.

To customize the SSH server, for example to restrict the allowed algorithms or add host certificates, add configuration files to the sshd_config.d directory of your configuration volume. The image includes every *.conf file in /etc/gitlab/sshd_config.d/.

If the directory does not exist or is empty, the SSH server uses the default configuration.

The SSH server uses the first value it finds for most settings, and the drop-in files are read before the defaults in /assets/sshd_config. A drop-in file can therefore override settings that secure the container, such as AllowUsers, PasswordAuthentication, and AuthorizedKeysCommand. Only change the settings you need to.

Files added to the sshd_config.d directory:

  • Are read in alphabetical order. Prefix file names with numbers such as 10-macs.conf.
  • With an invalid setting prevent the SSH server from starting. Always run the check-in in the steps below before you restart the container.

The algorithm names in the steps below are for illustration. Check that your SSH clients support the algorithms you allow, because removing an algorithm can lock out older clients.

To add a configuration file to customize SSH server:

  1. On the Docker host, create the directory in your configuration volume:

    shell
    sudo mkdir -p $GITLAB_HOME/config/sshd_config.d

  2. Create a file to drop in to the configuration folder. For example, to allow only two message authentication code (MAC) algorithms:

    shell
    sudo tee $GITLAB_HOME/config/sshd_config.d/10-macs.conf <<'EOF'
MACs [email protected],[email protected]
EOF

  3. Make sure the directory and files are owned by root and not writable by group or others:

    shell
    sudo chown -R root:root $GITLAB_HOME/config/sshd_config.d
sudo chmod -R go-w $GITLAB_HOME/config/sshd_config.d

  4. Check the resulting configuration:

    shell
    sudo docker exec gitlab /usr/sbin/sshd -t -f /assets/sshd_config

    If the command prints an error, fix the dropped in file before you continue.

  5. Restart the container:

    shell
    sudo docker restart gitlab

  6. Optional. Confirm the setting is in effect:

    shell
    sudo docker exec gitlab /usr/sbin/sshd -T -f /assets/sshd_config | grep -i '^macs'

Configure multiple database connections

GitLab defaults to using two database connections that point to the same PostgreSQL database.

If, for any reason, you wish to switch back to single database connection:

  1. Edit /etc/gitlab/gitlab.rb inside the container:

    shell
    sudo docker exec -it gitlab editor /etc/gitlab/gitlab.rb

  2. Add the following line:

    ruby
    gitlab_rails['databases']['ci']['enable'] = false

  3. Restart the container:

    shell
    sudo docker restart gitlab

Next steps

After you configure your installation, consider taking the recommended next steps, including authentication options and new user account restrictions.