Build a Secure GitLab Docker Pipeline

Learning objectives

• Build and tag the image
• Scan the image for vulnerabilities
• Generate an SBOM
• Push to a registry on success
• Fail the pipeline on defined severity

Before you start

Required software: Docker Engine 24+; a GitLab instance or gitlab.com project (optional to run end-to-end)

Prerequisites: Docker Image Engineering path, Docker Security path

1. Download and unzip the lab.
2. Review the app + starter .gitlab-ci.yml. You can validate the scan/SBOM/gate stages locally without a GitLab runner using the provided run-local.sh.

Instructions

Hints

💡 Make the gate fail-closed

The scan step should exit non-zero on the chosen severity so the pipeline stops. With Trivy, use --exit-code 1 --severity HIGH,CRITICAL.

💡 SBOM

Generate a CycloneDX/SPDX SBOM (e.g. with Syft) as a build artifact so downstream consumers can audit dependencies.

Validate your work

From the lab folder, run:

bash validation/validate.sh

The script reads only your local Docker state, never transmits data off your machine, and returns a status code:

• 0 — Lab successfully completed
• 1 — Validation failed
• 2 — Required dependency missing
• 3 — Lab environment not running
• 4 — Configuration error
• 5 — Validation timed out

Note: validation targets Linux first. On Docker Desktop (macOS/Windows) some host-level checks (e.g. disk usage) may report differently; each script documents its limitations.

Solution

Reset the lab

• docker compose down -v && docker compose up -d from the original lab files restores the starting (broken) state.

Interview questions

• How do you make a CI scan step block a release?
• What is an SBOM and why generate one in CI?
• How should image tags be structured for traceability and rollback?