The container reads the same gitlab.rb keys as a package installation. They reach it in two ways: through the GITLAB_OMNIBUS_CONFIG environment variable, which is evaluated on every start, and through /etc/gitlab/gitlab.rb on the configuration volume, which is read after the variable. What each key means and which values it takes is on the Linux package page.
Configuration through the environment variable
The variable holds gitlab.rb lines and is set when the container is created:
docker run -d --name code \
--shm-size 256m \
-p 80:80 -p 443:443 -p 22:22 \
-e GITLAB_OMNIBUS_CONFIG="external_url 'https://<HOSTNAME>'; gitlab_rails['omniauth_enabled'] = true; gitlab_rails['omniauth_allow_single_sign_on'] = ['openid_connect']; gitlab_rails['omniauth_auto_link_ldap_user'] = true" \
-v /srv/code/config:/etc/gitlab \
-v /srv/code/logs:/var/log/gitlab \
-v /srv/code/data:/var/opt/gitlab \
<REGISTRY>/<FLAVOR>:<VERSION>The variable is fixed when the container is created, so changing it means removing the container and creating a new one with the same volumes.
Configuration in gitlab.rb on the volume
The provider entries and the LDAP servers are multi-line values, and the configuration volume keeps them across container replacements. With the volumes from the quick start, /etc/gitlab/gitlab.rb inside the container is /srv/code/config/gitlab.rb on the host. Edit it on the host:
sudo vi /srv/code/config/gitlab.rbWrite the same keys as on a package installation:
gitlab_rails['omniauth_enabled'] = true
gitlab_rails['omniauth_providers'] = [
{
name: 'openid_connect',
label: 'Keycloak',
allowed_groups: ['gitlab'],
admin_groups: ['admin'],
groups_attribute: 'gitlab_group',
args: {
name: 'openid_connect',
scope: ['openid', 'profile', 'email'],
response_type: 'code',
issuer: 'https://keycloak.example.com/realms/example',
discovery: true,
client_auth_method: 'query',
uid_field: 'preferred_username',
send_scope_to_token_endpoint: false,
pkce: true,
client_options: {
identifier: '<client_id>',
secret: '<client_secret>',
redirect_uri: 'https://code.example.com/users/auth/openid_connect/callback'
}
}
}
]
gitlab_rails['ldap_enabled'] = true
gitlab_rails['ldap_servers'] = YAML.load <<-'EOS'
main:
label: 'Head office'
host: ldap-main.example.com
port: 3389
uid: 'cn'
bind_dn: 'uid=viewer,ou=People,dc=example,dc=com'
password: 'viewer123'
base: 'ou=People,dc=example,dc=com'
sync_name: true
group_sync:
create_groups: true
base: 'ou=Groups,dc=example,dc=com'
filter: '(objectClass=groupOfNames)'
top_level_group: 'LdapGroups'
owner: 'root'
role_mapping:
- by_name: '.*-developer-.*'
gitlab_role: 'developer'
EOSA key written in the file overrides the same key in GITLAB_OMNIBUS_CONFIG.
Applying the configuration
Apply the edited file inside the running container:
docker exec code gitlab-ctl reconfigureA container restart applies the configuration as well, and it is the way a changed GITLAB_OMNIBUS_CONFIG of a recreated container takes effect:
docker restart code