From b69b9deb9ceff383ef3e9a8b53e1b3bb8d35f499 Mon Sep 17 00:00:00 2001
From: esahin90 <emre.tr@outlook.com>
Date: Wed, 28 May 2025 12:33:03 +0200
Subject: [PATCH] nixos/gitlab-runner: add options for privileged services

The dockerServicesPrivileged and dockerAllowedPrivilegedServices limit
which containers are allowed to run in privileged mode in the GitLab CI.
---
 .../gitlab-runner/runner.nix                  | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix b/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix
index 693229b87d97..cc96d1373f56 100644
--- a/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix
+++ b/nixos/modules/services/continuous-integration/gitlab-runner/runner.nix
@@ -189,11 +189,15 @@ let
                         [ "--docker-image ${service.dockerImage}" ]
                         ++ optional service.dockerDisableCache "--docker-disable-cache"
                         ++ optional service.dockerPrivileged "--docker-privileged"
+                        ++ optional service.dockerServicesPrivileged "--docker-services_privileged true"
                         ++ optional (service.dockerPullPolicy != null) "--docker-pull-policy ${service.dockerPullPolicy}"
                         ++ map (v: "--docker-volumes ${escapeShellArg v}") service.dockerVolumes
                         ++ map (v: "--docker-extra-hosts ${escapeShellArg v}") service.dockerExtraHosts
                         ++ map (v: "--docker-allowed-images ${escapeShellArg v}") service.dockerAllowedImages
                         ++ map (v: "--docker-allowed-services ${escapeShellArg v}") service.dockerAllowedServices
+                        ++ map (
+                          v: "--docker-allowed-privileged-services ${escapeShellArg v}"
+                        ) service.dockerAllowedPrivilegedServices
                       )
                     )
                   )
@@ -521,6 +525,13 @@ in
                 Give extended privileges to container.
               '';
             };
+            dockerServicesPrivileged = mkOption {
+              type = types.bool;
+              default = false;
+              description = ''
+                Give extended privileges to services.
+              '';
+            };
             dockerExtraHosts = mkOption {
               type = types.listOf types.str;
               default = [ ];
@@ -554,6 +565,19 @@ in
                 Whitelist allowed services.
               '';
             };
+            dockerAllowedPrivilegedServices = mkOption {
+              type = types.listOf types.str;
+              default = [ ];
+              example = [
+                "docker.io/library/docker:*-dind-rootless"
+                "docker.io/library/docker:dind-rootless"
+                "docker:*-dind-rootless"
+                "docker:dind-rootless"
+              ];
+              description = ''
+                Whitelist allowed privileged services.
+              '';
+            };
             preGetSourcesScript = mkOption {
               type = types.nullOr (types.either types.str types.path);
               default = null;