Install GitLab in Docker environment

Preface#

This article describes how to install GitLab using Docker in a Debian 11 environment.

Create Git user group and user#

First, create the git user group and user:

groupadd -g 998 git
useradd -m -u 998 -g git -s /bin/sh -d /home/git git

It is recommended to execute the above commands before installing Docker.
It is known that using apt to install Docker will create a docker group with GID 998 by default, which conflicts with the git group of GitLab. Creating a group with GID 998 in advance can avoid manual modification.

Install Docker and Docker Compose#

Refer to:

Create the application#

Create the GitLab application and the data folder /app/gitlab:

mkdir -p /app/gitlab
mkdir -p /app/gitlab/data/{config,logs,data}

Create the /app/gitlab/docker-compose.yaml file with the following content:

version: '3'

services:
  gitlab:
    image: gitlab/gitlab-ce:14.7.2-ce.0
    container_name: gitlab
    restart: always
    privileged: true
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'https://example.com';
        nginx['enable'] = false;
        gitlab_rails['trusted_proxies'] = ['172.17.0.0/24', '10.0.0.0/8'];
        gitlab_workhorse['listen_network'] = 'tcp';
        gitlab_workhorse['listen_addr'] = '0.0.0.0:8181';
        gitlab_workhorse['gitlab_ssh_host'] = 'git.example.com';
    ports:
      - '8181:8181'
      - '2222:22'
    volumes:
      - /etc/localtime:/etc/localtime:ro
      # - /app/gitlab/data/data/.ssh/id_rsa.pub:/gitlab-data/ssh/authorized_keys:ro
      - /app/gitlab/data/config:/etc/gitlab
      - /app/gitlab/data/logs:/var/log/gitlab
      - /app/gitlab/data/data:/var/opt/gitlab
    shm_size: '256m'
    deploy:
      resources:
        limits:
          cpus: 2
          memory: 4G

Replace example.com with the domain name of GitLab and git.example.com with the domain name of SSH.

Go to the application folder, pull the image, and initialize the service:

cd /app/gitlab
docker-compose pull
docker-compose up -d

Configuration#

First, stop the service:

docker-compose down

Modify the /app/gitlab/data/config/gitlab.rb file, uncomment and modify the following lines:

external_url 'https://example.com'
gitlab_rails['gitlab_ssh_host'] = 'git.example.com'
gitlab_rails['time_zone'] = 'Asia/Shanghai'
gitlab_rails['smtp_enable'] = true
gitlab_rails['smtp_address'] = "smtp.example.com"
gitlab_rails['smtp_port'] = 587
gitlab_rails['smtp_user_name'] = "smtp_user"
gitlab_rails['smtp_password'] = "smtp_password"
gitlab_rails['smtp_domain'] = "example.com"
gitlab_rails['smtp_authentication'] = "login"
gitlab_rails['smtp_enable_starttls_auto'] = true
gitlab_rails['gitlab_email_enabled'] = true
gitlab_rails['gitlab_email_from'] = 'noreply@example.com'
gitlab_rails['gitlab_email_display_name'] = 'Example'
gitlab_rails['gitlab_email_reply_to'] = 'noreply@example.com'
gitlab_rails['gitlab_default_theme'] = 2
gitlab_rails['gravatar_plain_url'] = 'https://gravatar.loli.net/avatar/%{hash}?s=%{size}&d=identicon'
gitlab_rails['gravatar_ssl_url'] = 'https://gravatar.loli.net/avatar/%{hash}?s=%{size}&d=identicon'
gitlab_shell['auth_file'] = "/var/opt/gitlab/.ssh/authorized_keys"

Start the service and apply the configuration:

docker-compose up -d

SSH forwarding#

Map the SSH key inside the container to the host:

rm -rf /home/git/.ssh
ln -sf /app/gitlab/data/data/.ssh /home/git/.ssh

Generate the communication key from the host to the container:

su - git
ssh-keygen

Create gitlab-shell:

mkdir -p /opt/gitlab/embedded/service/gitlab-shell/bin
touch /opt/gitlab/embedded/service/gitlab-shell/bin/gitlab-shell
chmod a+x /opt/gitlab/embedded/service/gitlab-shell/bin/gitlab-shell

The content of /opt/gitlab/embedded/service/gitlab-shell/bin/gitlab-shell is as follows:

#!/bin/sh
ssh -i /home/git/.ssh/id_rsa -p 2222 -o StrictHostKeyChecking=no git@git.example.com "SSH_ORIGINAL_COMMAND=\"$SSH_ORIGINAL_COMMAND\" $0 $@"

Note: Add git.example.com to the /etc/hosts file and point it to 127.0.0.1.

Modify the docker-compose.yaml file and uncomment the line that mounts /gitlab-data/ssh/authorized_keys.

Restart the service:

docker-compose down
docker-compose up -d

Configure nginx forwarding#

Example nginx configuration file:

upstream gitlab-workhorse {
  server 127.0.0.1:8181 fail_timeout=0;
}

server {
  listen 80;
  listen [::]:80 ipv6only=on;
  server_name example.com;
  server_tokens off;
  return 301 https://$http_host$request_uri;
}

server {
  listen 443 ssl;
  listen [::]:443 ipv6only=on ssl;
  server_name example.com;
  server_tokens off;

  include enable-ssl.conf;
  include enable-hsts.conf;

  ssl_certificate /data/ssl/example.com/fullchain.pem;
  ssl_certificate_key /data/ssl/example.com/privkey.pem;
  ssl_trusted_certificate /data/ssl/example.com/ca.pem;

  location / {
    client_max_body_size 0;
    gzip off;

    proxy_read_timeout 300;
    proxy_connect_timeout 300;
    proxy_redirect off;

    proxy_http_version 1.1;

    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-Ssl on;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_pass http://gitlab-workhorse;
  }
}

Conclusion#

Open https://example.com in a browser and give it a try!