The CI/CD Rabbit Hole: What Self-Hosted GitLab Runners Don't Tell You

Self-hosting GitLab (see the previous post) is one thing; getting its CI to reliably build and push Docker images is another. My first two weeks of pipeline history are almost entirely trial and error: TLS certificate errors, insecure-registry flags, runner tags, Docker-in-Docker aliases — the same handful of problems in a dozen different disguises.

The turning point was abandoning Docker-in-Docker entirely in favor of buildah, which sidesteps the privileged-runner and TLS headaches almost completely. On top of that I layered SonarQube and Trivy for static analysis and vulnerability scanning, and hardened every container image to run as a non-root user. None of this is glamorous, but if you're self-hosting GitLab runners for a side project, it's the unglamorous work that decides whether you ship at all.