GitLab Runner

Maintenance

• Verify resources: authenticate Docker Hub image checks !7162

Bug fixes

• [19.0] Key S3 client cache by config value, not pointer !6983

Bug fixes

• [19.1] Key S3 client cache by config value, not pointer !6982

New features

• Add Snowplow writer for usage-based billing !5886
• Add nanoserver:ltsc2025 and nanoserver:ltsc2025-arm64 helper images !6717 (Shanush Prema Thasarathan @shanushpt)
• Add native steps support to the instance executor !6807
• Add ability to push image indexes with pusher !5316 (Anthony Juckel @ajuckel)
• Make git credential helper visible to user-authored commands !6729
• Improve error message for wrong-architecture container images (closes #38824) !6907 (Ashmit Sharma @4shm1td06)
• Add circuit breaker for runner fallback to Rails on Relay failures !6839
• Add feature_qualified_name to Snowplow billing metadata !6898
• Add runner-side Job Router metrics !6841
• Eliminate duplicate ContainerInspect calls in resume flow (closes #39458) !6790 (Ashmit Sharma @4shm1td06)
• Auto-select arm64 Windows helper image on ARM64 hosts !6854 (Shanush Prema Thasarathan @shanushpt)
• Add concrete-mode pod assembly for the Kubernetes executor !6817
• Allow multiple/alternative filter flags in clear-docker-cache script (closes #39234) !6912 (Ashmit Sharma @4shm1td06)
• Run a synthetic job at startup before reporting Ready !6756
• Read sentry_dsn from SENTRY_DSN environment variable !6899
• Enable metrics for Snowplow writer for usage logging !6649

Security fixes

• Bump golang.org/x/net to v0.56.0 to resolve CVEs !6856
• Bump go-jose/go-jose/v4 to v4.1.4 to resolve CVE-2026-34986 !6857

Bug fixes

• Point default helper image tag at latest Alpine base !6897
• Remove Docker stop-kill timeout and add duration logging !6951
• Bump github.com/moby/spdystream to v0.5.1 !6885
• Reclassify benign WaitDelay outcome in script_legacy step !6848
• Update labkit/v2 to 2.26.1 !6914
• Fix powershell generate save script !6713 (Sean Fausett @gitfool)
• Stage concrete scratch under the build mount, not os.TempDir() !6832
• Use Runner UUID as subject in snowplow billing event !6903
• Fix disconnectNetwork container ID matching !6872 (Pishel @pishel65)
• Fix autoscaler pruning active instances on token rotation !6810
• Docker+machine: Fix VM leak when shutdown races a machine create or remove !6754
• Increase Docker stop timeout to 2m and improve error messaging !6868
• Add --docker-pull-policy flag to register command (closes #39304) !6930 (Ashmit Sharma @4shm1td06)
• Classify invalid docker DNS/MAC address as ConfigurationError !6942
• Retry transient docker image pull failures !6873
• Update module github.com/go-git/go-git/v5 to 5.19.1 !6884
• Classify secret-resolution failures by cause !6904

Maintenance

• 202606 - Fix broken external links !6843
• Product Docs AI Translation: GITTECHA-835 #1 !6866
• Enable minmax modernizer in golangci-lint !6875
• Migrate from .tool-versions to mise.toml !6880
• Classify invalid docker container-create requests as ConfigurationError !6958
• Install splitic from its canonical module path !6935
• Add FreeBSD supported versions statement !6908
• Update grpc to v1.81.1 in runner_wrapper (CVE-2026-33186) !6940
• [FixPipeline] https://gitlab.com/gitlab-org/gitlab-runner/-/pipelines/2637656030 !6894
• Wrap plain errors in image-pull paths with BuildError !6844
• Add TLS, DNS, and many-exposed-ports integration tests for moby v29 !6925
• Bump base-images to 0.0.45 !6845
• Wrap remaining plain errors in Kubernetes Prepare() with BuildError !6881
• Fix nonexistent timeout key names in Custom executor !6938
• Update RUNNER_IMAGES_VERSION to 0.0.47 to resolve ubi-fips CVEs !6950
• Adds GITTECHC to use for CI Translations !6909
• Product Docs AI Translation: GITTECHA-703 #1 !6783
• Stop pinning exact digest in helper image config test !6944
• Fix UBI image trigger artifact ref for merge train and detached pipelines !6877
• (docsi18n) - Monthly maintenance - fix markdown lint errors in docs-locale !6959
• Update the version or the logging field validator !6956
• Retry jobs interrupted by external termination !6921
• Remove dead code from CI pipeline definitions !6826
• Update docker Docker tag to v27.5.1 !6461
• Pass git clean args as separate args in submodule foreach !6949
• Product Docs AI Translation: GITTECHA-834 #1 !6865
• Add AGENTS.md and CLAUDE.md files for documentation !6860
• Improve Go build caching strategy in CI !6906
• Add RHEL-family libvirt base image, fix --os-variant !6937
• Document dns and mac_address validation behavior !6947
• Migrate Docker SDK to moby/moby v29 to fix docker/* CVEs !6902
• Use per-branch Go build cache with main fallback !6915
• Rootless Podman resource limits (cgroups v2) and socket safety !6936
• Builtin functions implement BuiltinFunction interface !6874
• Product Docs AI Translation: GITTECHA-836 #1 !6867
• Classify image-pull access-denied errors as ConfigurationError !6850

Bug fixes

• Fix Bash script body leak on job cancellation !6861

Maintenance

• Disable TestKubernetesBuildPodResources !6878

Bug fixes

• Fix Bash script body leak on job cancellation !6870

Maintenance

• Disable TestKubernetesBuildPodResources !6879

Bug fixes

• Increase Docker stop timeout to 2m and improve error messaging !6868

New features

• feat(kubernetes): add MatchLabelKeys & MismatchLabelKeys for PodAffinityTerm !6711 (Tobias Germer @germert)
• Fall back to direct polling when the Job Router is disabled !6811
• Add native windows/arm64 helper binary build target !6697 (Shanush Prema Thasarathan @shanushpt)
• Add suspend/resume support to the Docker Autoscaler executor !6719
• Skip job request and warn when runner token is empty !6821
• Use fresh context in StopKillWait when build ctx is cancelled !6636
• Retry secrets retrieval !6072 (Syed Saif Ali Alvi @syedsaifalialvi)
• Bundle native arm64 helper binary in windows-servercore-ltsc2025-arm64 image !6716 (Shanush Prema Thasarathan @shanushpt)
• docker+machine: Add discovered placement labels to autoscaling metrics !6740
• Kubernetes executor: add imagePullSecrets support for pause pods !6672 (Ashmit Sharma @4shm1td06)
• Docker: support PidMode for setting PID namespace !6694 (Diego Becciolini @itizir)
• Send environment key as part of job status update !6813
• Add get_sources timeout to runner config !6822
• Introduce gitlab_runner_process_state_info metric !6793

Bug fixes

• Fix jobs stuck in canceling due to missing final update !6770
• clear-docker-cache: fall back to podman when docker is absent !6755
• Fix concrete execution divergences from abstract shell !6801
• Silence exec-cleanup warning under Podman !6773
• Fix Bash script body leak on job cancellation !6784
• clear-docker-cache: drop unsupported -a from podman volume prune !6808
• Update to Go 1.26.3 !6760
• Forward job variables to concrete's nested run: dispatch !6825
• Scope http.proactiveAuth to remote host !6798
• docker+machine: cap finalizeRemoval retries !6791
• Remove need for grep to enable pipefail !6739 (Matt Clarkson @mattyclarkson)
• Update warning for alias overlap in executors/docker/services.go !6742
• Expand variables in image_name log fields !6809
• Fix flaky test !6786

Maintenance

• Product Docs AI Translation: GITTECHA-704 #1 !6785
• Product Docs AI Translation: GITTECHA-707 #1 !6796
• Add artifact timeout options !6761
• Refactor prepare_timeout !6778
• Update docker-machine version to the latest one !6775
• Update redirecting links to resolved URLs !6831
• Docs - May 2026 maintenance - fix links !6803
• Add french and korean seed content !6751
• Update FF_USE_ADAPTIVE_REQUEST_CONCURRENCY section for accuracy !6820
• docs(docker): document dind MTU inheritance gap and workaround !6737
• Manage golangci-lint via mise !6824
• Honor FF_TIMESTAMPS and reclassify benign exec outcomes in concrete !6769
• Explicitly tell to move away from the Fargate driver !6667
• Clarify FIPS Runner support across distributions !6812
• go: Update module k8s.io/apimachinery to v0.35.2 !6482
• Set explicit FailureReason on BuildError constructions across executors !6724
• Update base images version to pick up CVE fixes !6765
• Product Docs AI Translation: GITTECHA-708 #1 !6797
• Argo Translations from GITTECHA-647 #1 !6777
• Add missing appsec labels !5680
• Docs Follow-Up: Supported shells !6718 (Pishel @pishel65)
• Restore ShellWriter CommandWithStdin !6608 (Guillaume Chauvel @guillaume.chauvel)
• Fix cidr typo !6676 (Paul Gear @paulgear)
• Disable TestKubernetesBuildPodResources !6827
• Product Docs AI Translation: GITTECHA-702 #1 !6789
• Product Docs AI Translation: GITTECHA-706 #1 !6795
• Update docker-machine version !6800
• Add a few more flaky tests to .flaky-tests !6780

Bug fixes

• Update to go 1.26.3 [backport to 19.0] !6788

New features

• Document prepare_timeout setting !6731
• Add OpenTelemetry tracing for CI job execution !6518
• Add LTSC2025 and LTSC2025-arm64 based gitlab-runner-helper images for windows !6033 (Shanush Prema Thasarathan @shanushpt)
• Use Pipeline ID form job payload for logging and similar !6631
• Allow configuring parallelism and chunk sizes for cache uploads and... !6401 (Rafael Fonseca @rafael.fonseca1)
• Dispatch run: through concrete via a nested step-runner job !6703
• Add mount propagation option to emptyDir volumes !6553 (Rafael Fonseca @rafael.fonseca1)
• Add StepRunnerStream writer that detects pre-stamped lines !6710
• Enforce prepare_timeout config field !6708
• Add mode label to failed_jobs_total and job_duration_seconds metrics !6620
• User Job Cancellation Calls Cancel API !6681
• Treat span id as required !6692
• Map step-runner errors to job failure reasons !6597
• Add support for nfs mounts !6544 (Julian Rettelbach @rettelbachj)
• Cache: list valid types and accept any case for cache Type !6736
• Add suspend/resume support for instance autoscaler executor !6570
• Add prepare_timeout config field !6653
• Add variable with network name when using FF_NETWORK_PER_BUILD !6632 (Pishel @pishel65)

Bug fixes

• Merge branch 'sh-fix-role-arn-injection' into 'main' !6714
• Update Kubernetes executor service container naming documentation !6730
• Recover helper argv when image entrypoint drops CMD !6725
• Adaptive request concurrency: do not treat retried requests as capacity !6677
• Restore timeout-warning trace parity with legacy in concrete mode !6704
• Go Dependency update: github.com/invopop/jsonschema to resolve CVE-2026-32285 !6696
• Merge branch 'security-fix-k8s-uid-gid-root-bypass' into 'main' !6643
• Add support for specifying seccomp profile path in Docker executor !6602 (Felix Geyer @debfx)
• Fix proxy-exec and step-runner hangs when scripts spawn background processes !6707
• Fix per secret overrides for role_arn and role_session_name AWS Secrets Manager integration !6067 (derikwang @derik01)
• Pass proactiveAuth to git checkout for partial-clone lazy fetches !6695
• Normalize Windows exit codes from unsigned to signed 32-bit !6587
• Scope CONFIG_FILE default to manager command structs !6741
• Update the parallels executor to work with Windows guests !105 (Chris Rose @cdrx)
• Fix S3 cache broken on third-party providers by SDK checksum defaults !6691
• Fix dependencies on UBI downstream pipeline trigger job !6684
• Expose service variables in custom executor CUSTOM_ENV_CI_JOB_SERVICES !6556 (Sepehr Heydari @sepehrheydari72)
• Fix the randomize shell selection in Windows shell executor !6644 (Pishel @pishel65)
• Fix slice size !6732
• Fix gaps in the abstract shell to concrete migration !6688
• Add HEAD method support to S3v2 presign URL !6682 (Sepehr Heydari @sepehrheydari72)
• Escape $ as $$ in Kubernetes env var values to prevent $(VAR) expansion !6640
• Fix home environment variable !101

Maintenance

• Fix typo: simlar → similar in troubleshooting docs !6654 (Bob Singh @bobsingh.dev)
• Fix typos and grammar in templates !6658 (Bob Singh @bobsingh.dev)
• Simplify CI job architecture for Go linting !6752
• Add Node.js to dev tools !6750
• Add French and Korean to Argo !6612
• Cache: select newer remote artifact when FF_HASH_CACHE_KEYS is toggled !6574
• Add shellcheck for shell script linting !6625
• Timestamper improvements (perf, potential bug fix) !6698
• Set explicit FailureReason on BuildError constructions across executors !6683
• Update base images version to pick up CVE fixes (19.0 backport) !6776
• Resolve shell script issues flagged by shellcheck !6734
• Fix missing 'to' in sentence !6656 (Bob Singh @bobsingh.dev)
• Followup MR for MR 6663 !6673
• Fix race in TestPodWatcher on Windows: listen before Create !6623
• Common: make executor retry sleep interruptible by context cancellation !6610 (Bob Singh @bobsingh.dev)
• Clarify gitlab com version !6720
• Reference kuberenetes executor service account permissions required for certain feature flags !6668
• Docker machine version 46 !6693
• Fix RPM package architecture names in download docs !6634
• Fix grammar in feature flag rollout template !6661 (Bob Singh @bobsingh.dev)
• Fix grammar in bug issue template !6664 (Bob Singh @bobsingh.dev)
• Remove erroneous entry from changelog !6728
• Fix hyphenation in Cross-Functional Programs heading !6660 (Bob Singh @bobsingh.dev)
• Reorder executor tables to surface actively developed executors first !6638
• Fix grammar in documentation issue template !6663 (Bob Singh @bobsingh.dev)
• Fix goroutine variable capture in shutdownUsedExecutorProviders !6606 (Bob Singh @bobsingh.dev)
• Fix typos and grammar in security template !6659 (Bob Singh @bobsingh.dev)
• Automatically retry flaky tests !6687
• Reorganize TestCredSetup !6607 (Guillaume Chauvel @guillaume.chauvel)
• Update file docker.md !6627
• Update RUNNER_IMAGES_VERSION to 0.0.42 to resolve ubi-fips CVEs !6733
• Docs(docker-machine): update docs !6689
• Update shell support in docs !6647 (Pishel @pishel65)
• Remove EOL spaces in doc files - 2026-04-28 !6686
• Fix context propagation in Kubernetes executor !6364 (Emmanuel 326 @Emmanuel326)
• Clarify documention on default shell in windows !6645 (Pishel @pishel65)
• Clean up Podman with Kubernetes examples !6626
• Update file docker.md !6738
• Update linting tools and linting container image for documentation !6706
• Add overview descriptions to executor pages !6702
• Fix grammar in feature flag cleanup template !6662 (Bob Singh @bobsingh.dev)
• Add hadolint for Dockerfile linting !6635
• Go: Update module github.com/jedib0t/go-pretty/v6 to v6.7.9 !6671
• Creates a gitlab_runner_cache_s3_assume_role_failures_total metric !6655
• Cache: shard S3 object paths by first two chars of hash when FF_HASH_CACHE_KEYS is enabled !6628
• Fix duplicate word typos in various source file comments !6586 (Igor Eccard @iseccard) …

Bug fixes

• Merge branch 'sh-fix-role-arn-injection' into '18-11-stable' !6715

Bug fixes

• Add HEAD method support to S3v2 presign URL !6682 (Sepehr Heydari @sepehrheydari72)
• Fix S3 cache broken on third-party providers by SDK checksum defaults !6691

Bug fixes

• Merge branch 'security-fix-k8s-uid-gid-root-bypass' into 'main' !6643

New features

• Consolidate the HTTP Status Code field !6492
• Change the concrete helper image to use shell-form CMD !6591
• Cache AssumeRole credentials to reduce STS requests !6549
• Implement Concrete CI Function !6410
• Add logging field validator CI job !6580
• Fix default artifacts upload timeout values !6584
• Add k8s nodename to pod phase output !6311 (Thorsten Banhart @banhartt)
• Add native steps job counter metric !6369
• Bundle git and CA certificates for concrete runner !6504
• Update builtins to use step-runner BuiltinContext interface !6616
• Add seccomp and AppArmor profile support to Kubernetes executor security context !6512 (Marc Ullman @MarcUllman)
• Kubernetes: add PodDisruptionBudget support for job pods !6331
• Pass socket path from step-runner serve to proxy command !6507
• Resolve "Windows Runners: Document "session 0" restrictions (screen resolution statically set to 1024x768)" !4994
• Kubernetes: autoscaler for idle capacity via pause pods !6334

Bug fixes

• Update FF_SCRIPT_SECTIONS documentation to reflect current behavior !6519 (Pishel65 @pishel65)
• Rate-limit and instrument S3 AssumeRole calls !6528
• Cache/s3v2: cache S3 client to reduce IMDS requests !6530
• PowerShell/Pwsh environment variables can't process special characters in their names. !6502 (Pishel65 @pishel65)
• Fix proxy-mask credential store file permissions on Unix !6510
• Fix disable_cache disabling all volumes instead of only cache !6552 (Aaron Döppner @aarondpn-sp)
• Restore fixed runner command path !6529
• Use custom endpoint in detectBucketLocation !6532
• Log warning when DOCKER_AUTH_CONFIG credentials resolution fails !6578
• Properly escape ANSI color codes in shell scripts !6527
• Improve step_script to bring it on part with Runner legacy path !6596
• Revert "Remove GPG signing color" !6554

Maintenance

• No global executors !6508
• Patch(cache): ensure cache exists before uploading !6569
• Highlight actively developed executors !6585
• Bump up runner images version to 0.0.38 !6541
• Cache: rename local artifact when FF_HASH_CACHE_KEYS is toggled !6546
• Update Windows backward compatibility support !6523 (Pishel65 @pishel65)
• Add Support for Windows Server 24H2 !6522 (Pishel65 @pishel65)
• Add Pipeline Security group as code owners for secrets managers !6474
• Link to main branch for runner-helper Dockerfiles !6533 (Sven Hoexter @hoexter)
• Standardize runner capitalization in Docker Machine autoscale docs !6615
• Adding test for new alert format !6550
• Update CI components !6517
• Fix autoscale documentation typos !6611 (Bob Singh @bobsingh.dev)
• Add boundary test cases for statusClass !6551 (Bob Singh @bobsingh.dev)
• Pilot runners failover !6536
• Remove all references to PackageCloud !6514
• Add Duo Workflow agent configuration and instructions !6588
• Properly support Job Router FF from runner config !6545
• AI Translated Documentation Push: GITTECHA-610 !6577
• Docs(docker-machine): update docs !6534
• Creating documentation about Windows helper images !6525 (Pishel65 @pishel65)
• Documented fallback correlation ID !6531
• Docs maintenance: Fix and update broken URLs !6526
• Revert "Merge branch 'malvarez-consolidate-http-status-code-field' into 'main'" !6524
• Removing the mention of packagecloud !6582
• Fix alert boxes in translated documentation !6595
• Changing warning format !6539
• Rename Kubernetes Agent Server to GitLab Relay (KAS) !6583
• Document interactive desktop requirement for Windows GUI tests !6571
• Clarify post_build_script and after_script execution behavior !6573
• Update RPM package naming from amd64 to x86_64 !6543
• Updating note format !6537
• Tidy up Markdown in documentation !6520