With over 25 years of IT experience and
more than 3,500 students trained since 2017,
my passion is helping aspiring engineers
develop real-world technical skills.
My teaching approach combines practical
hands-on labs, enterprise engineering
concepts, AI-enabled learning and
personalized career guidance.
You don't need to be an expert to start.
You need the right guidance, consistent
practice and a clear roadmap.
Your Next Chapter Starts Today.
Imagine where you could be a year from now
if you started learning today.
How to Configure GitLab Runner with Docker Executor on Ubuntu 24.04 EC2
In this tutorial, we will configure a
self-hosted GitLab Runner with Docker Executor on an AWS EC2 Ubuntu 24.04
instance.
With the Docker executor, each GitLab CI/CD job runs inside an isolated Docker
container. This allows the same runner to execute pipelines using different
environments such as Maven, Python, Node.js, or Ubuntu without installing all
of those tools directly on the EC2 instance.
Using Docker executor provides isolation and flexibility because different
CI/CD jobs can use different container images without requiring every build
tool to be installed directly on the runner EC2 instance.
You can now extend this setup to build real CI/CD pipelines using:
Tomcat Manager is configured for remote deployment.
SonarQube Quality Gate is configured.
GitLab Runner can reach both SonarQube and Tomcat.
What We Will Implement
We will perform the following steps:
Generate a SonarQube authentication token.
Configure SonarQube and Tomcat credentials as GitLab CI/CD variables.
Create a .gitlab-ci.yml pipeline.
Build the Java application using Maven.
Scan the project using Trivy.
Analyze the source code using SonarQube.
Enforce the SonarQube Quality Gate.
Deploy the WAR file to Tomcat only when all previous stages succeed.
What is Trivy?
Trivy is an open-source security scanner used in DevSecOps pipelines to
identify vulnerabilities and other security issues. In this lab, we use
Trivy to scan the application filesystem and dependencies for HIGH and
CRITICAL vulnerabilities.
Trivy → Security/Vulnerability Scanning
SonarQube → Code Quality & Static Code Analysis
Step 1 – Create a SonarQube Token
Login to SonarQube.
Go to:
My Account → Security → Tokens
Enter a token name and generate an analysis token.
Copy the generated token.
Save the token securely. You will add it to GitLab as a CI/CD variable.
Step 2 – Configure GitLab CI/CD Variables
Go to your GitLab project:
Settings → CI/CD → Variables
Click Add variable.
Configure the following variables:
Variable
Purpose
SONAR_HOST_URL
SonarQube server URL
SONAR_TOKEN
SonarQube authentication token
TOMCAT_HOST
Tomcat hostname/IP and port
TOMCAT_USER
Tomcat Manager username
TOMCAT_PASSWORD
Tomcat Manager password
Do not hard-code passwords or tokens inside .gitlab-ci.yml.
Step 3 – Create the GitLab CI/CD Pipeline
Go to the GitLab repository containing your Java project.
As soon as you commit .gitlab-ci.yml, GitLab creates and starts
the pipeline.
Go to:
Build → Pipelines
You should see the pipeline execute in this order:
1. Build
Maven compiles the Java application and generates the WAR file.
↓
2. Trivy Security Scan
Trivy scans the project filesystem and dependencies for known vulnerabilities.
If vulnerabilities matching the configured
HIGH or CRITICAL severity threshold are detected, the Trivy
command returns a non-zero exit code and the pipeline stops.
↓
3. SonarQube Code Analysis
SonarQube analyzes the application code.
The pipeline waits for the SonarQube Quality Gate result because we
configured:
-Dsonar.qualitygate.wait=true
If the Quality Gate fails, the SonarQube job fails and
deployment does not proceed.
↓
4. Deploy to Tomcat
Only when the previous stages succeed does GitLab execute the deployment job.
The WAR artifact generated during the build stage is deployed to Tomcat using
the Tomcat Manager API.
Step 6 – Verify Trivy Security Scan
Go to: GitLab → Build → Pipelines → trivy_scan Review the Trivy scan results in the job log. If no HIGH or CRITICAL vulnerabilities matching the configured criteria
are found, the job passes and the pipeline continues. If HIGH or CRITICAL vulnerabilities are detected, the job fails because
we configured: --severity HIGH,CRITICAL --exit-code 1
Step 7 – Verify the SonarQube Report
Login to SonarQube and open the project.
Review the analysis results, including the applicable:
Bugs
Vulnerabilities
Code Smells
Security Hotspots
Duplications
Coverage
Quality Gate status
Verify that the Quality Gate shows PASSED.
Step 8 – Verify the Application
After the pipeline completes successfully, open the Java web application
running on Tomcat.
http://<TOMCAT-PUBLIC-DNS>:8080/MyWebApp
You should see the deployed Java web application.
The complete DevSecOps workflow is now:
Developer
↓
GitLab Repository
↓
GitLab Runner
↓
Maven Build
↓
Trivy Security Scan
↓
SonarQube Code Analysis
↓
Quality Gate
↓
Tomcat Deployment
↓
Java Web Application
Key Takeaway
GitLab manages and orchestrates the CI/CD pipeline, while
GitLab Runner executes the jobs using the Docker images
defined in .gitlab-ci.yml.
The application is deployed only after the configured
Trivy security check and SonarQube Quality Gate succeed,
providing security and quality checks before deployment.
How to Integrate HashiCorp Vault with Jenkins Pipeline on Ubuntu 24.04 ?
What is HashiCorp Vault?
HashiCorp Vault is a secrets-management platform used to securely store and control access to sensitive information such as:
Passwords
API tokens
Database credentials
Cloud credentials
GitHub tokens
Nexus/Artifactory credentials
Deployment credentials
Instead of storing application secrets directly inside Jenkins, Jenkins can authenticate to Vault and retrieve only the secrets required by a pipeline.
Prerequisites
Jenkins up and running
New EC2 instance for Vault with port no 22 and 8200 opened
