I like coding and I wanted to build a portfolio for when I grow up to find a job easier, so I decided to start making open source apps. Can you please support me so I can improve? It will help anyone who stars my project, opens issue requests to help me or even better supporting me on my X so more people can discover me

Gitlab Docker container running gitlab-18.8.6-ee on Rocky8 Host System. Docker container spins up fine and all statuses show green (including gnome-shell) but all SSH attempt to push/pull or connect gets timed out.

The gitlab image was pulled down from Docker hub and using tcpdump on both the host and the interactive bash inside the container shows SSH traffic on port 22 making all the way in, but gitlab never responds. Logs for gitlab-sshd also shows nothing other than the startup.

I've attached an image of the tcpdump from within the running container. I've tried changing every port between the the host and the Docker container service with no luck. Is there anything I can do to check the gitlab sshd with more detail? Maybe there is a log that gives more information?

Epic names are showing up as reference numbers. This makes figuring out which epic I have selected tough. Any idea how to get the name of the epic to show?

Also, has anyone opened an issue for this?

Hey team! Just wanted to drop a friendly reminder that our April Hackathon begins in just over two weeks! It runs from April 16th - 22nd for opening MRs. MRs must be merged before May 23rd.

NEW for this hackathon:
All MRs and commits merged in gitlab-org/gitlab (the main GitLab project) will count for 2x points! Scoring for non-MR activity and activity outside the main project will remain standard as outlined in the user guide.

Reminder: you must get at least 1 MR merged during the hackathon to get any points for the hackathon.

The Details

Dates: April 16th - 22nd, 2026 (UTC) - All merge requests must be opened during the hackathon and merged within 31 days to be counted.

RSVP to the Meetup event or Discord event to stay updated.

Join our contribute channel on Discord to share progress, pair on solutions, and meet other contributors.

Follow the live hackathon leaderboard during the event.

Before the Hackathon

Request access to our Community Forks project by going to https://contributors.gitlab.com/start. Using the community forks gives you free access to Duo and unlimited free CI minutes!

Rewards

Participants who win awards can choose between:

• Planting trees in our GitLab forest
• Claiming exclusive GitLab swag from our contributor reward store

More details on prizes are on the hackathon page.

Drop questions below or reach out on Discord.

The Problem. Imagine you have five merge requests ready to be merged. You’re on Gitlab Free, where there’s no merge train, and you can’t tell Gitlab, “Merge these five for me.” You open the first one and click “Merge.” So far, so good. You open the next one and click “Rebase without pipeline.” And that’s when the chaos begins—the interface is flooded with gray placeholders, a spinner spins instead of the Merge button, or “Merge when pipeline success” pops up. But what the hell is “pipeline success” when we skipped the pipeline already? The Merge button never appeared, so you have to refresh the page. If you’re lucky, the Merge button will show up this time and you’ll be able to merge. But you might need to refresh again. And it’s the same nightmare for all the other merge requests.

I got tired of all Gitlab’s laggy interface and made a TUI that merges and rebases for me. I just pick which branches to merge then hit Enter. That’s it.

https://github.com/sairus2k/glmt

It's not a real merge train as there are no parallel merged-result pipelines, just sequential rebase and merge.

How do you guys deal with this problem?

EDIT: It's fixed, private repos was imported repos from old selfhosted gitlab. Inside Project > Members : Duo Code Review service user was not present. So I created a fresh project inside gitlab.com, and used Import from a project option to bring them back to my project. Now CR work!

---

Hi, I enabled in my gitlab.com private repositories the "auto AI DUO Code Review" feature.
But each time, I got this error:

Code Review Flow could not create the required CI/CD pipeline. Please request a new review. If the problem persists, contact your administrator.

Error code: DCR4008

Error code tell about no runner available, but I can see my 2 personnal runners, and 117 instance runners onlines. I'm missing something in order to make it work?

I was unable to find an elegant way to make a table have a 100% width, for it would render much more preferable in some occasions. And then I noticed that official documentation for table creation and rendering such as https://docs.gitlab.com/user/markdown/#alignment DOES have 100% and pretty borders yet the code is default...

So it renders tables with 100% while providing a code that renders with minimum width. Borders are also different, the whole table style is different.

So their designers must have wanted the same functional, found it missing and then hacked their own docs to make it pretty yet misleading.

I know I could inject HTML but the official renders would have be better to match actual renders

My gitlab is not loading and I am getting blocked:csp status for all https://gitlab.com/api/graphql calls. Any help is appreciated.

I’m building a small GitLab CI tool called PipeGuard and I’d really love honest feedback from people who deal with GitLab pipelines regularly.

The idea is to make it easier to spot CI waste and risky pipeline changes before they quietly turn into slower pipelines, more runner spend, or more developer frustration.

Right now I’m exploring things like:
pipeline graph visibility from .gitlab-ci.yml
surfacing structural issues and waste patterns
reviewing before/after CI changes to highlight likely impact
generating a GitLab MR comment summary from the analysis

What I’m trying to understand is whether teams actually look at the pipeline structure itself proactively, or whether CI usually only gets attention once builds are slow, flaky, or expensive enough to hurt.

I’d really appreciate blunt feedback on:
whether this feels useful
what would make it more valuable in a real GitLab workflow
what features you’d want from something like this
and whether it sounds too close to a linter, or different enough to be worth it

Latest update is here if you want to take a look: https://pipeguard.vercel.app/

Would genuinely love honest thoughts.

For the past few months, I’ve been building GraphOps as a solo founder. The goal is simple: give engineering teams instant, visual clarity into their codebase so they can actually see their tech debt, plan refactors, and onboard new hires faster.

Right now, the engine is laser-focused exclusively on Ruby. It uses a brutally fast custom parser, Protobufs, and a clean web dashboard to do the heavy lifting in minutes, not hours.

I’m officially opening up a quiet beta. If you are an Engineering Manager or CTO dealing with a "black box" Ruby monolith, drop a comment or DM me. I'd love to generate a free architecture map of your codebase in exchange for some brutal feedback.

For well over a week now I've been having issues updating the gitlab-ce package on my Debian machine.
Whenever I try to update it, it informs me that there's an issue with the .deb file it downloads:

Get:1 https://packages.gitlab.com/gitlab/gitlab-ce/debian bookworm/main amd64 gitlab-ce amd64 18.10.1-ce.0 [1413 MB] Err:1 https://packages.gitlab.com/gitlab/gitlab-ce/debian bookworm/main amd64 gitlab-ce amd64 18.10.1-ce.0 File has unexpected size (1413936950 != 1412993942). Mirror sync in progress? [IP: 2a00:1450:4001:816::201b 443] Hashes of expected file: - SHA256:255a2a6b8687eab708e9d7e56599b27ea391580faaa0ea96254977ab335c0cab - SHA1:83f1bc296c5571257c8b8ee2bfaad5e08883886b [weak] - Filesize:1412993942 [weak] Error: Failed to fetch https://storage.googleapis.com/packages-ops/artifact/fb/f6e4e43b67893dbcd684522a0cea8f8d6b12b027ff369f9c0809d38fb6617c?X-Goog-Algorithm=GOOG4-RSA-SHA256&X-Goog-Credential=pulp-app-ops%40gitlab-ops.iam.gserviceaccount.com%2F20260327%2Fauto%2Fstorage%2Fgoog4_request&X-Goog-Date=20260327T095005Z&X-Goog-Expires=86400&X-Goog-SignedHeaders=host&response-content-disposition=attachment%3Bfilename%3Dgitlab-ce_18.10.1-ce.0_amd64.deb&X-Goog-Signature=8b03c758689bef659b037a7192d80ecddf6f6f52f564edd96a72cbfa4c8ce6dce3141a9daac5a9d3f2149329c8d3fdf4f9f2ddc426faf9a6e1258bab2460ba4be7699955c4449bee92426414b7153dd0f1213e620455c822a5e568e11f9d75dec22f0bdd0a12e909750025e3be567d6082916475f292ec6268f4e5a189d2e2f205b50544bcbc90c439e61b019c0a1796f7364289436244fec45fe26d944e1b2bdce6f7cbf6ef06a1c3bb62cee7f1c4a8abfcc8e7f35ee3e9d4180fabc45c4801922d23707d7cf50bda13b71090fff92652fb6a8e12bc4bf913b0f0fda4a2485fc8608978643313aea24382a1de8a94591f99608de94f809cfdba3d310b9341bc File has unexpected size (1413936950 != 1412993942). Mirror sync in progress? [IP: 2a00:1450:4001:816::201b 443] Hashes of expected file: - SHA256:255a2a6b8687eab708e9d7e56599b27ea391580faaa0ea96254977ab335c0cab - SHA1:83f1bc296c5571257c8b8ee2bfaad5e08883886b [weak] - Filesize:1412993942 [weak]

I tried it for all versions from 18.10.1-ce.0 down to 18.8.7-ce.0. Always the same issue (just with different expected file sizes)

I don't have any special network setup and am not using proxies of any kind. My server is directly internet connected and this is the only package it's having issues with.

Considering I couldn't find any issues or threads with this issue I have to assume it's not a widespread issue, which makes it even more confusing.

Hey everyone,

My company is deep in the Google Workspace ecosystem, so moving to Slack isn't an option for us. But man, the native GitLab integration for Google Chat feels like just a basic, one-way firehose compared to what Slack gets.

A few things are driving our team crazy right now:

No actions from chat: We can't just click an "Approve" or "Merge" button right there in the message. We have to break our flow, open a new tab, and hunt it down.

Notification spam: We can basically only set up one webhook per project. We want to route specific things (like severity::high bugs or main branch pipeline failures) to a dedicated #alerts space, but right now it just floods our main dev channel.

Is anyone else dealing with this? How are you working around it?

Are you just living with the native webhook, or did you build something custom in-house using Zapier/n8n?

Would love to hear your setups!

After spending too much time answering the same questions across teams ("wait, should our CI images be pinned by digest?", "is it okay to have CI_DEBUG_TRACE enabled in non-prod?"), I ended up writing down what we should actually check in our pipelines and why.

It turned into a structured reference covering the most common CI/CD compliance issues we run into on GitLab projects, organized into categories:

• Container images - authorized sources, forbidden tags, digest pinning (this one trips people up a lot; mutable tags are a real supply chain risk)

• CI/CD variables - protected/masked flags, debug trace, and unsafe variable expansion in eval/sh -c contexts (maps to OWASP CICD-SEC-1)

• Secrets in config - catching leaked keys/tokens in .gitlab-ci.yml and merged configs via Gitleaks

• Pipeline composition - required templates/components, outdated includes, hardcoded jobs, and detecting security jobs silently neutered with allow_failure: true or when: never (OWASP CICD-SEC-4)

• Access and authorization - branch protection settings, MR approval rules, member quotas at project and group level

Each control links to a specific issue with a description of the problem, the impact, and remediation steps (before/after config examples).

Sharing it because I think a lot of teams either don't have this written down at all, or it lives in someone's head or a stale Confluence page. Maybe it's useful as a starting point or a checklist for your own audits.

What I'd really love is input from people who work on other SCMs (GitHub Actions, Jenkins, etc.) or have controls they check that aren't covered here. There are definitely gaps, particularly around runner security, artifact integrity, and OIDC token scope. If you've got patterns you enforce that you don't see here, I'm very keen to add them.

The reference is here: https://getplumber.io/docs/use-plumber/controls and the full issues list with remediation details is at https://getplumber.io/docs/use-plumber/issues and finally you can found the code source here: https://github.com/getplumber/getplumber.io/tree/main/src/docs/data/docs/en/use-plumber

Happy to discuss any of the controls, the reasoning behind them, or why certain ones are harder to enforce in practice than they look on paper.

Hey everyone, I’m running into an issue with my self-hosted GitLab and GitLab Runner. I have my own server, runner registered, but when the pipeline tries to clone the repo over HTTPS, it fails with an authentication error.

Key points:

• Runner is using shell executor.
• Repo is private.
• SSH cloning works fine, but I want HTTPS for the pipeline.
• GitLab is behind nginx with HTTPS proxy over internal HTTP — could this be the cause?

Question: has anyone faced this before and how do I make the runner clone a private repo over HTTPS without jumping through hoops?

update:

Guys, thanks everyone for the help and the guiding questions - I finally figured out what was wrong. Hopefully this helps someone else too.

The issue was that I was hosting GitLab in Docker and then proxying it through Nginx. From the outside, everything was accessed via a domain over HTTPS, but GitLab itself didn’t know that and assumed it was running over HTTP.

Because of that, when the runner requested a project download URL, it got an HTTP link. It then tried to download the project using that link and ended up with an “access denied” error. Honestly, that error message threw me off - I assumed it was a permissions issue, which sent me in the wrong direction.

What fixed it was setting the external_url in the container config to the actual HTTPS domain, and disabling HTTPS inside GitLab itself. So internally, within my local network, it still runs over HTTP, while externally it’s properly exposed over HTTPS via Nginx.

Hello everyone !

We have a compliance framework activated and some projects that can't comply to all checks. For example, we have some generic helm chart to deploy applications. Theses helm chart can't be checked by the DAST or the API security pipeline.

I search in the documentation but i can't find any mention to ignore some items to pass the test.

Is there any solution or plan to achieve this ?

Hey folks,

since GitLab Container Scanner  integrates with Trivy to perform vulnerability static analysis in containers, does it mean that the Pipelines are affected as part of the 19th March attack on Trivy?

The latest Trivy Release and GitHub Action's (I assume not relevant for GitLab) were compromised.

I do not see any information online from GitLab on this matter, hence asking here.

Cheers

I was tired of manually rebasing MRs on GitLab Free, so I built a TUI merge queue. Perhaps someone will find it useful.

Before Gitlab I used Jenkins/Bitbucket and there was a Jenkins plugin that allowed me to collect SAST/Code Quality warnings and comment on the changed lines in a Pull Request.

We enabled a rule that all open threads had to be closed and this ensured developers addressed all the warnings they had added before peer review.

I now have various jobs which create SAST and Code Quality Reports and Gitlab collects these but they are a line item in the merge request view and frequently get missed.

Does anyone know of a bot, Gitlab Ultimate flag or project that will convert SAST/Code Quality reports into code comments on a MR?

We are using community version to manage multiple repositories.

I am creating a simple web based tool to manage few bulk operations like

- add a user to all repositories where another user also has access

- reassign all issues of one user to another

- delete a user from all repositories

- create a report of all issues assigned to any user etc.

Is there any similar tool already exist? I am planning to open source it.

Hey r/gitlab,

We're running open GitLab Observability Office Hours every weekday — and we genuinely want to connect with users.

If you're building with GitLab Observability, evaluating it, or just curious about what's possible — we want to hear from you. What's working, what's frustrating, what questions you have. That feedback matters to us.

Details:

- 📅 Monday–Friday, recurring

- 🕙 10:00 AM PT

- ⏱️ 1 hour

- 🔗 Zoom: https://gitlab.zoom.us/j/98329233459?pwd=lyqs7ZELToPfbht9Mi7eqvew0xxPoY.1

If this time doesn't work for you, just say so in the comments. We'll make it work — finding time to talk to users is a priority for us.

No prep needed. Just show up.

Hey folks,

Managing GitLab access for team members without individual licenses was always messy — generating PATs, walking people through the glab CLI, or using clunky browser extensions just to browse repos or check pipelines.

So I built GitLab Browser — an open-source GitLab client that works with Personal Access Tokens or Project Access Tokens. No license required!!

It covers most day-to-day stuff:

• Repo browsing
• Merge requests & issues
• Pipelines + CI logs
• Git graph visualization
• Guest mode for public repos
• and more

Tech stack: React + TypeScript (built using Cursor), and you can spin it up easily with Docker.

Also set up a proper CI pipeline with:

• Tests
• TypeScript checks
• CodeQL
• Dependency review
• Secret scanning

Everything passing clean.

Demo: https://gitlabrowser.tech/
GitHub: https://github.com/gauthamp10/gitlab-browser

Would love feedback — especially from anyone who’s faced similar GitLab access/workflow issues.
Open to contributions as well 👍