Device Protection in GitLab CI/CD

GitLab CI/CD jobs run on Linux runners, so Device Protection installs the same way it does on any Linux machine. What is specific to GitLab is where the install goes: once on a shell executor host that stays around, or inside each job on the Docker and Kubernetes executors.

Read Install Device Protection for Linux first for the token and the install flavors. The job-level snippets below use the container flavor, which Device Protection in Containers explains.

Docker and Kubernetes executors

This covers GitLab.com hosted runners too. Add your Device Protection token as a masked CI/CD variable named AIKIDO_TOKEN, then start the agent in before_script:

default:
  before_script:
    - curl -fsSL https://github.com/AikidoSec/safe-chain/raw/refs/heads/main/install-scripts/install-endpoint-linux.sh | sh -s -- --container
    - aikido-endpoint-protection-start --wait-for-healthy
    - for f in /etc/profile.d/aikido-*.sh; do . "$f"; done

install:
  image: node:20-bookworm
  script:
    - npm ci

• before_script shares a shell with script, so the sourced settings reach your commands. A job with its own before_script replaces the default one, so repeat the three lines there.
• The job must run as root, and the image needs curl.

Shell executor

Install the agent on the runner host with --headless, then reboot. See Install Device Protection for Linux.

Verify it works

verify-device-protection:
  image: node:20-bookworm
  script:
    - curl -sS -o /dev/null -w "%{http_code}\n" --max-time 15 https://registry.npmjs.org/safe-chain-test/-/safe-chain-test-0.0.1-security.tgz

403 means the agent blocked the malware test package. 200 means the download skipped the agent.

Troubleshooting