[Solved] Blank Page After Multiple Logins on Docker Registry

In my omnibus-type installation, I have identified an issue when running multiple logins simultaneously in a pipeline. This occurs only when the following variables are present:

variables:
  DOCKER_HOST: tcp://docker:2375/
  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: ""

In practice, it seems that due to multiple simultaneous logins, the user who initiated the pipeline encounters an error and/or gets blocked. If I attempt to continue using the UI, I get a blank page, and the executed calls return an HTTP status of 403:

image927×707 93.2 KB

image541×566 29.4 KB

Here is the complete test file:

.publish-docker-config: &publish-docker-config
  tags: [docker-image]
  image: docker:20-dind
  stage: build
  services:
    - name: docker:20-dind
      entrypoint: [ "env", "-u", "DOCKER_HOST" ]
      command: [ "dockerd-entrypoint.sh" ]
  before_script:
    - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" $CI_REGISTRY
    - sleep 5000


variables:
  NIGHTLY_BUILD: ""
  SEND_TO_SONARQUBE: ""
  DOCKER_HOST: tcp://docker:2375/
  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: ""


stages:          # List of stages for jobs, and their order of execution
  - build
  - test
  - deploy

build-job:       # This job runs in the build stage, which runs first.
  <<: *publish-docker-config
  stage: build
  script:
    - echo "Compiling the code..."
    - echo "Compile complete."


build-job-2:       # This job runs in the build stage, which runs first.
  <<: *publish-docker-config
  stage: build
  script:
    - echo "Compiling the code..."
    - echo "Compile complete."

build-job-3:       # This job runs in the build stage, which runs first.
  <<: *publish-docker-config
  stage: build
  script:
    - echo "Compiling the code..."
    - echo "Compile complete."

build-job-4:       # This job runs in the build stage, which runs first.
  <<: *publish-docker-config
  stage: build
  script:
    - echo "Compiling the code..."
    - echo "Compile complete."
    


build-job-5:       # This job runs in the build stage, which runs first.
  <<: *publish-docker-config
  stage: build
  script:
    - echo "Compiling the code..."
    - echo "Compile complete."



build-job-6:       # This job runs in the build stage, which runs first.
  <<: *publish-docker-config
  stage: build
  script:
    - echo "Compiling the code..."
    - echo "Compile complete."

And here are the runner configurations:

[[runners]]
  name = "docker-image-runner"
  url = "https://aaaaaaaaaaaaaaaaaa"
  id = 11
  token = "aaaaaaaaaaaaaaaaaaaaa"
  token_obtained_at = 2023-08-30T15:14:42Z
  token_expires_at = 0001-01-01T00:00:00Z
  executor = "docker"
  concurrent = 2
  [runners.cache]
    MaxUploadedArchiveSize = 0
  [runners.docker]
    concurrent = 2
    tls_verify = false
    image = "docker:20-dind"
    privileged = true
    disable_entrypoint_overwrite = false
    oom_kill_disable = false
    disable_cache = false
    volumes = ["/cache"]
    extra_hosts = [
      "gitrepo.local:192.168.1.1",
      "gitlab.local:192.168.1.1",
      "registry.local:192.168.1.1"
    ]
    shm_size = 0

the versions:

• gitlab: v16.3.0-ee

• gitlab-runner:

$ gitlab-runner -v
Version:      16.3.0
Git revision: 8ec04662
Git branch:   16-3-stable
GO version:   go1.20.5
Built:        2023-08-20T17:57:47+0000
OS/Arch:      linux/amd64

I couldn’t figure out which logs to review; I just noticed that after a few hours, the user becomes usable again. Does anyone kindly have any tips to understand how and where to analyze the issue?

I solved the issue by creating a dedicated token for deployment. I went to:
“Project Menu” → Settings → Access Token → “Add new token”

The scopes I didn’t select (I’m not certain if all of them are really necessary) were: api, read_api, read_registry, write_registry

At this point, I registered two protected and masked variables ($CI_PUBLISH_REGISTRY_USER, $CI_PUBLISH_REGISTRY_PASSWORD) in:
“Project Menu” → Settings → CI/CD → Variables

The variables contain respectively:

• CI_PUBLISH_REGISTRY_USER = “token name”
• CI_PUBLISH_REGISTRY_PASSWORD = “generated access token”

Finally, I modified the login part with the variables just saved:

.publish-docker-config: &publish-docker-config
  tags: [docker-image]
  image: docker:20-dind
  stage: build
  services:
    - name: docker:20-dind
      entrypoint: [ "env", "-u", "DOCKER_HOST" ]
      command: [ "dockerd-entrypoint.sh" ]
  before_script:
    - docker login -u "$CI_PUBLISH_REGISTRY_USER" -p "$CI_PUBLISH_REGISTRY_PASSWORD" $CI_REGISTRY
    - sleep 5000