Service Pinning¶

Service containers (for example docker:dind) should use explicit versions.

Bad¶

build:
  services: [docker:dind]

Good¶

build:
  services: [docker:24.0.5-dind]

Policy¶

From security/service-pinning.feature:

Scenario: docker:dind must include a version
  Given I have any job defined
  When it has services
  Then its services must not match "docker:dind$"
  And its services must match "docker:[0-9]+\\.[0-9]+\\.[0-9]+-dind"

Consume in GitLab CI¶

Offline policy:

include:
  - local: example-ci/compliance-jobs.yml

compliance:
  extends: .compliance:offline

Run locally¶

gitlab-compliance check -f policies/security/ -p .gitlab-ci.yml

Back to Examples.