限制从 gitlab.com 访问 gitlab-runner

Question

I've installed a gitlab-runner instance on my server. I currently set up the firewall as allowing access to port 443, which the gitlab-runner is running on. There are no further restrictions configured though and I'd like to see it limited to gitlab.com only.

Is it possible to limit the source IPs to gitlab's? Or is it safe to have a firewall rule that just opens port 443 for the runner?

Note: the executor is docker unprivileged

Answer 1

You dont need to open any incoming ports, all the communication is from your runner instance to the gitlab.com

Your runner check every x time if there is a job to pull. It just need an internet access to reach (https) the gitlab.com site.