GitLab CI Pipeline - Deploy Static Website via Nginx Container, Multi-branch Deployment, Run container without Root Privileges

Table of Contents

GitHub Repository Available

Overview
#

In this tutorial I’m using the following setup based on Ubuntu 22.04 servers, GitLab is dockerized:

192.168.70.4 # GitLab
192.168.70.5 # GitLab Runner
192.168.70.6 # Main / Production Deployment 
192.168.70.7 # Dev Deployment

GitHub Repository:
https://github.com/jueklu/gitlab-ci-container-deployment

Prerequisites
#

Create SSH Key
#

Create a SSH key pair on the server where GitLab is deployed:

# Create SSH key pair
ssh-keygen -t rsa -b 2048

Create a User for the Container Deployment
#

On the deployment servers, create a new user “gitlab-deployment” for the GitLab CI pipeline:

# Create user for the GitLab deployment
sudo adduser gitlab-deployment

# Add the user to the Docker group
sudo usermod -aG docker gitlab-deployment

Add Public Key & Fingerprint
#

Copy the public SSH key to the authorized keys file of the Deployment servers:

# Copy the public SSH key: Default "id_rsa.pub" key
ssh-copy-id gitlab-deployment@192.168.70.6
ssh-copy-id gitlab-deployment@192.168.70.7

# Copy the public SSH key: Specific key name
ssh-copy-id -i ~/.ssh/filename.pub gitlab-deployment@192.168.70.6
ssh-copy-id -i ~/.ssh/filename.pub gitlab-deployment@192.168.70.7

SSH into the deployment servers to add the fingerprint:

# SSH into deployment server
ssh gitlab-deployment@192.168.70.6
ssh gitlab-deployment@192.168.70.7

DNS Entry
#

Make sure the deployment servers can resolve the DNS names of GitLab and the GitLab Registry:

# Add the following DNS entry
192.168.70.4 gitlab.jklug.work gitlab-registry.jklug.work

GitLab Repository
#

Create Dev Branch
#

Create the second dev branch:

# Create a new "dev" branch
git checkout -b dev

# Verify the current branch
git branch

# Shell output:
* dev
  main

# Push changes to remote repository
git push origin dev

File & Folder Structure
#

The file and folder structure of both the main and thedev branch of the GitLab repository look like this:

GitLab-Repository
├── Dockerfile
├── .gitlab-ci.yml
├── README.md
└── website
    └── index.html

SSH Key / CI/CD Variable
#

Add the previously created private SSH key to the GitLab Repository:

Go to: (Project)
Select “Settings” > “CI/CD”
Expand the “Variables” section
Click “Add variable” to add a variable for your private SSH Key.

Note: Remove the “Protect variable” option.

Dockerfile
#

The same Dockerfile is used for both branches:

Dockerfile

# Alpine-based NGINX image with unprivileged (non-root) default user
FROM nginxinc/nginx-unprivileged:stable-alpine

# Temporarily switch to "root" user to perform permission adjustments
USER root

# Set variable for the document root
ARG DOCROOT=/usr/share/nginx/html

# Copy website files into the document root and set ownership to the "nobody" user
COPY --chown=nobody:nobody website/ ${DOCROOT}

# Adjust permissions
RUN find ${DOCROOT} -type d -print0 | xargs -0 chmod 755 && \
    find ${DOCROOT} -type f -print0 | xargs -0 chmod 644 && \
    chmod 755 ${DOCROOT}

# Switch back to the "nginx" user for running the container
USER nginx

# Expose port 8080 for the container
EXPOSE 8080

HTML File
#

Use different HTML files for the dev and the production / main branch:

Main / Production Branch
#

website/index.html

<!DOCTYPE html>
<html>

<head>
	<title>jklug.work</title>
</head>

<body>
  <h1>Deploy website via Nginx container</h1>
  <p>Main / production branch</p>
</body>

</html>

Dev Branch
#

website/index.html

<!DOCTYPE html>
<html>

<head>
	<title>jklug.work</title>
</head>

<body>
  <h1>Deploy website via Nginx container</h1>
  <p>Dev branch</p>
</body>

</html>