
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
gitlab-images
Advanced tools
gitlab-images is in alpha. Expect breaking changes, crashes and big explosions. Use under your responsability 😇
CLI tool to convert a gitlab repository to a managed gitlab docker image registry
Tested only with a custom gitlab instance, don't know if it works with gitlab.org
To install it, you will need to have already configured:
When you have your gitlab + runner + container registry, you can continue
npm i -g gitlab-imagesgitlab.mydomain.com/devops/images and a docker registry at registry.mydomain.comgit clone ssh://git@gitlab.mydomain.com/devops/images.gitcd imagesgitlab-images install
gitlab-images install example output" sectionWhen you push the changes, your runner should start a pipeline with 2 jobs:
- 🛠️ docker-builder
- 🏷️ docker-builder CI_SHA > production
Jobs with the emoji 🛠️ are builds, and with 🏷️ tagging jobs.
At this point, your repository is initialized with gitlab-images
README WIP
gitlab-images new <folder name>
Push your changes
gitlab-images install example outputNote: Markdown cannot show colors, so to see them you will need to install it 🙃
fox@foxdev:~/git/devops/lab$ gitlab-images install
Debugger attached.
gitlab-images v0.2.0
Wellcome to the installation wizard🧙 for gitlab-images
Target path '/home/fox/git/devops/lab'
? Is this the path where you want to install gitlab-images? Yes
No 'gitlab-images.config.yml' found. Assuming new installation
? Your gitlab registry (ex: registry.your-gitlab.com) registry.mydomain.com
? Where will be the images located? (ex: /devops/images) /devops/images
This configuration will be used to execute command
? Is 'registry.mydomain.com/devops/images' correct? Yes
-=Docker builder image=-
The docker builder meta image is the image that will be used to build your images
You can modify whatever you want in it, add debugging tooling for your docker images etc
? Coma separated list of tags for the runners that will build images exec:docker,service:docker-builder
- exec:docker
- service:docker-builder
? Are this tags correct? Yes
No README.md found. A new one will be created
-=Installation=-
We are going to make modifications inside the path
/home/fox/git/devops/lab
Its recommended first to have a repository initialized, so you can diff the changes, or revert if the tool brokes something
? Install? Yes
EXEC> mkdir .devops
EXEC> cp $TEMPLATES/install/.devops/gitlab-images.hbs.yml > ~Hydrate~ > .devops/gitlab-images.yml
EXEC> cp $TEMPLATES/install/.gitignore > .gitignore
EXEC> mkdir docker-builder
EXEC> cp $TEMPLATES/install/docker-builder/.config.yml > docker-builder/.config.yml
EXEC> cp $TEMPLATES/install/docker-builder/Dockerfile > docker-builder/Dockerfile
EXEC> cp $TEMPLATES/install/docker-builder/gitlab-images-0.2.0.tgz > docker-builder/gitlab-images-0.2.0.tgz
EXEC> cp $TEMPLATES/install/gitlab-images.config.hbs.yml > ~Hydrate~ > gitlab-images.config.yml
EXEC> cp $TEMPLATES/install/README.hbs.md > ~Hydrate~ > README.md
-=gitlab-images installed!=-
If is the first time installing gitlab-images (aka is not an update) follow this!
Before pushing the changes, the first docker-builder image must be manually created
Please run:
$ docker login registry.mydomain.com
$ gitlab-images docker build docker-builder
- Select "production" tag
- Push to registry: yes
To initialize the first docker-builder image
When you are done, you can commit and push the changes:
$ git add --all
$ git commit -m "Initialized gitlab-images"
$ git push
Installation done! 🚀
FAQs
CLI tool to convert a gitlab repository to a gitlab docker image registry
We found that gitlab-images demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.