WikiBR - Contributions [fr]

Mettre en place SSH pour Gitlab/en

2026-08-11T11:52:34Z

Daniela.cojocaru : Page créée avec « {{Attention|Cette commande génère deux fichiers dans le dossier <code>C:\Users\<ton_nom>\.ssh</code> : la clé privée (<code>id_ed25519</code>) et la clé publique (<code>id_ed25519.pub</code>). '''DO NOT SHARE THE PRIVATE KEY'''. It's the '''public key''' which should be added to Gitlab. We cannot stress enough this point. All the security counts on the fact that the private key stays secret.}} »

<languages/>
The aim of this guide is to help you set up a computer to use [[GitLab|GitLab]] with SSH authentication. It is aimed at beginners: for a more general introduction, see the main page on [[SSH]] and the BR’s [[Astuces_ssh|advanced tips]].

The installation steps for Windows 10 and 11 are described below. For Linux and macOS, please also refer to the main SSH guide.

The setup is relatively simple. Follow carefully the following steps.
= Prérequis =

Before you start, make sure you have [[Git|git]] installed on your computer. To check this:

* open a cmd or PowerShell terminal (press the Windows key + R, then type <code>cmd</code> or <code>powershell</code>);
* type <code>git -v</code> and check that Git is installed; if it isn’t, [https://git-scm.com/downloads install Git here];
* then type <code>ssh -V</code> to check that SSH is installed; if it isn’t, [https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse install OpenSSH here].

= Mise en place =

== Étape 1 : Générer une clé SSH ==

Open a terminal (cmd or powershell) and type the following command:

<syntaxhighlight lang="bash">ssh-keygen -t ed25519 -C "ordi portable vaneau"</syntaxhighlight>
Replace <code>ordi portable vaneau</code> with a name of your choice. You can leave the other fields empty by pressing <code>Enter</code> for each option.

Please note that there is an option to change the key’s name (by default <code>id_ed25519</code>) and the save location. There is also another option to add a passphrase to the key, which is recommended if your hard drive is not encrypted.

{{Attention|Cette commande génère deux fichiers dans le dossier <code>C:\Users\<ton_nom>\.ssh</code> : la clé privée (<code>id_ed25519</code>) et la clé publique (<code>id_ed25519.pub</code>). '''DO NOT SHARE THE PRIVATE KEY'''. It's the '''public key''' which should be added to Gitlab. We cannot stress enough this point. All the security counts on the fact that the private key stays secret.}}

== Étape 2 : Ajouter la clé SSH sur Gitlab ==

# Connecte-toi sur Gitlab avec tes identifiants Sigma BR ;
# Clique sur ton avatar en haut à gauche, puis sur <code>Preferences</code>, puis sur <code>SSH Keys</code> (ou va directement sur [https://gitlab.binets.fr/-/user_settings/ssh_keys cette page]) ;
# Clique sur <code>Add new key</code> ;
# Copie le contenu du fichier <code>C:\Users\<ton_nom>\.ssh\id_ed25519.pub</code> (ou un autre chemin si tu as choisi un autre emplacement) en remplaçant <code><ton_nom></code> par ton nom d’utilisateur Windows et colle-le dans le champ <code>Key</code> ;
# (optionnel) Supprime la date d’expiration de la clé si tu veux qu’elle reste valide indéfiniment ;
# Clique sur <code>Add key</code>.

== Étape 3 : Préparer SSH pour utiliser la clé ==

# Ouvre le dossier <code>C:\Users\<ton_nom>\.ssh</code> sur VSCode (ou ton éditeur de texte préféré) ;
# Crée un fichier <code>config</code> ('''sans extension''') ;
# Ajoute le contenu suivant :

Host gitlab.binets.fr
User git
IdentityFile C:\Users\<ton_nom>\.ssh\id_ed25519

En remplaçant <code><ton_nom></code> par ton nom d’utilisateur Windows.

== Étape 4 : Activer l'agent SSH ==

Taper <code>ssh-add -L</code>
* Si ta clef ssh est affichée, tout va bien, tu peux passer à l'étape suivante
* Sinon, suit ces étapes :

=== Sur windows ===

# Aller dans la recherche windows et lancer <code>Services</code>
# Chercher OpenSSH Authentification Agent
# Double cliquer dessus et mettre : <code>Type de démarrage : Automatique</code>
# Appuyer sur démarrer
# Dans un terminal, faire <code>ssh-add</code>

=== Sur Linux/Mac ===

Voilà une solution un peu nulle qu'il faudra refaire à chaque fois que tu redémarre ton ordi. Lance un terminal et tape :

eval `ssh-agent`
ssh-add

N'hésite pas à trouver une meilleure solution et à l'écrire ici.

== Étape 5 : Tester la connexion SSH ==

Pour tester la connexion SSH, ouvre un terminal et tape la commande suivante :

<syntaxhighlight lang="bash">ssh -T gitlab.binets.fr</syntaxhighlight>
Tu devrais voir un message comme ça :

The authenticity of host 'gitlab.binets.fr (129.104.201.46)' can't be established.
ED25519 key fingerprint is SHA256:sn+wsip9OTBcwiY0ZplULWXNij3v3kdj/tP228i2+70.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Écrit <code>yes</code> puis appuie sur <code>Entrée</code>.

Si tout s’est bien passé, tu devrais voir un message de bienvenue de Gitlab. Dans le cas contraire, vérifie que tu as bien suivi toutes les étapes précédentes. Si tu rencontres des difficultés, n’hésite pas à demander de l’aide au Binet Réseau en permanence ou sur PaniX.

== Étape 6 : Configurer l’identité Git ==

Pour finir, il faut configurer correctement ton identité sur Git. Dans ton terminal, tape les commandes suivantes :

<syntaxhighlight lang="bash">git config --global user.name "<Ton Nom>"
git config --global user.email "<ton.nom>@polytechnique.edu"</syntaxhighlight>
En remplaçant <code><Ton Nom></code> par ton nom et <code><ton.nom>@polytechnique.edu</code> par les valeurs adéquates.

Félicitations ! À partir de là, tu peux utiliser Gitlab avec une authentification SSH.

'''Lorsque tu clones un dépôt, veille bien à choisir le lien SSH et non HTTPS.'''

Translations:Mettre en place SSH pour Gitlab/9/en

2026-08-11T11:52:30Z

{{Attention|Cette commande génère deux fichiers dans le dossier <code>C:\Users\<ton_nom>\.ssh</code> : la clé privée (<code>id_ed25519</code>) et la clé publique (<code>id_ed25519.pub</code>). '''DO NOT SHARE THE PRIVATE KEY'''. It's the '''public key''' which should be added to Gitlab. We cannot stress enough this point. All the security counts on the fact that the private key stays secret.}}

Mettre en place SSH pour Gitlab/en

2026-08-11T11:50:45Z

Daniela.cojocaru : Page créée avec « Please note that there is an option to change the key’s name (by default <code>id_ed25519</code>) and the save location. There is also another option to add a passphrase to the key, which is recommended if your hard drive is not encrypted. »

<languages/>
The aim of this guide is to help you set up a computer to use [[GitLab|GitLab]] with SSH authentication. It is aimed at beginners: for a more general introduction, see the main page on [[SSH]] and the BR’s [[Astuces_ssh|advanced tips]].

The installation steps for Windows 10 and 11 are described below. For Linux and macOS, please also refer to the main SSH guide.

The setup is relatively simple. Follow carefully the following steps.
= Prérequis =

Before you start, make sure you have [[Git|git]] installed on your computer. To check this:

* open a cmd or PowerShell terminal (press the Windows key + R, then type <code>cmd</code> or <code>powershell</code>);
* type <code>git -v</code> and check that Git is installed; if it isn’t, [https://git-scm.com/downloads install Git here];
* then type <code>ssh -V</code> to check that SSH is installed; if it isn’t, [https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse install OpenSSH here].

= Mise en place =

== Étape 1 : Générer une clé SSH ==

Open a terminal (cmd or powershell) and type the following command:

<syntaxhighlight lang="bash">ssh-keygen -t ed25519 -C "ordi portable vaneau"</syntaxhighlight>
Replace <code>ordi portable vaneau</code> with a name of your choice. You can leave the other fields empty by pressing <code>Enter</code> for each option.

Please note that there is an option to change the key’s name (by default <code>id_ed25519</code>) and the save location. There is also another option to add a passphrase to the key, which is recommended if your hard drive is not encrypted.

<div lang="fr" dir="ltr" class="mw-content-ltr">
{{Attention|Cette commande génère deux fichiers dans le dossier <code>C:\Users\<ton_nom>\.ssh</code> : la clé privée (<code>id_ed25519</code>) et la clé publique (<code>id_ed25519.pub</code>). '''IL NE FAUT EN AUCUN CAS PARTAGER LA CLÉ PRIVÉE'''. C’est la '''clé publique''' qui doit être ajoutée sur Gitlab. On n’insistera jamais assez sur ce point. Toute la sécurité repose sur le fait que la clé privée reste secrète.}}
</div>

== Étape 2 : Ajouter la clé SSH sur Gitlab ==

# Connecte-toi sur Gitlab avec tes identifiants Sigma BR ;
# Clique sur ton avatar en haut à gauche, puis sur <code>Preferences</code>, puis sur <code>SSH Keys</code> (ou va directement sur [https://gitlab.binets.fr/-/user_settings/ssh_keys cette page]) ;
# Clique sur <code>Add new key</code> ;
# Copie le contenu du fichier <code>C:\Users\<ton_nom>\.ssh\id_ed25519.pub</code> (ou un autre chemin si tu as choisi un autre emplacement) en remplaçant <code><ton_nom></code> par ton nom d’utilisateur Windows et colle-le dans le champ <code>Key</code> ;
# (optionnel) Supprime la date d’expiration de la clé si tu veux qu’elle reste valide indéfiniment ;
# Clique sur <code>Add key</code>.

== Étape 3 : Préparer SSH pour utiliser la clé ==

# Ouvre le dossier <code>C:\Users\<ton_nom>\.ssh</code> sur VSCode (ou ton éditeur de texte préféré) ;
# Crée un fichier <code>config</code> ('''sans extension''') ;
# Ajoute le contenu suivant :

Host gitlab.binets.fr
User git
IdentityFile C:\Users\<ton_nom>\.ssh\id_ed25519

En remplaçant <code><ton_nom></code> par ton nom d’utilisateur Windows.

== Étape 4 : Activer l'agent SSH ==

Taper <code>ssh-add -L</code>
* Si ta clef ssh est affichée, tout va bien, tu peux passer à l'étape suivante
* Sinon, suit ces étapes :

=== Sur windows ===

# Aller dans la recherche windows et lancer <code>Services</code>
# Chercher OpenSSH Authentification Agent
# Double cliquer dessus et mettre : <code>Type de démarrage : Automatique</code>
# Appuyer sur démarrer
# Dans un terminal, faire <code>ssh-add</code>

=== Sur Linux/Mac ===

Voilà une solution un peu nulle qu'il faudra refaire à chaque fois que tu redémarre ton ordi. Lance un terminal et tape :

eval `ssh-agent`
ssh-add

N'hésite pas à trouver une meilleure solution et à l'écrire ici.

== Étape 5 : Tester la connexion SSH ==

Pour tester la connexion SSH, ouvre un terminal et tape la commande suivante :

<syntaxhighlight lang="bash">ssh -T gitlab.binets.fr</syntaxhighlight>
Tu devrais voir un message comme ça :

The authenticity of host 'gitlab.binets.fr (129.104.201.46)' can't be established.
ED25519 key fingerprint is SHA256:sn+wsip9OTBcwiY0ZplULWXNij3v3kdj/tP228i2+70.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Écrit <code>yes</code> puis appuie sur <code>Entrée</code>.

Si tout s’est bien passé, tu devrais voir un message de bienvenue de Gitlab. Dans le cas contraire, vérifie que tu as bien suivi toutes les étapes précédentes. Si tu rencontres des difficultés, n’hésite pas à demander de l’aide au Binet Réseau en permanence ou sur PaniX.

== Étape 6 : Configurer l’identité Git ==

Pour finir, il faut configurer correctement ton identité sur Git. Dans ton terminal, tape les commandes suivantes :

<syntaxhighlight lang="bash">git config --global user.name "<Ton Nom>"
git config --global user.email "<ton.nom>@polytechnique.edu"</syntaxhighlight>
En remplaçant <code><Ton Nom></code> par ton nom et <code><ton.nom>@polytechnique.edu</code> par les valeurs adéquates.

Félicitations ! À partir de là, tu peux utiliser Gitlab avec une authentification SSH.

'''Lorsque tu clones un dépôt, veille bien à choisir le lien SSH et non HTTPS.'''

Translations:Mettre en place SSH pour Gitlab/8/en

2026-08-11T11:50:44Z

Please note that there is an option to change the key’s name (by default <code>id_ed25519</code>) and the save location. There is also another option to add a passphrase to the key, which is recommended if your hard drive is not encrypted.

Translations:Mettre en place SSH pour Gitlab/7/en

2026-08-11T11:50:20Z

Daniela.cojocaru : Page créée avec « <syntaxhighlight lang="bash">ssh-keygen -t ed25519 -C "ordi portable vaneau"</syntaxhighlight> Replace <code>ordi portable vaneau</code> with a name of your choice. You can leave the other fields empty by pressing <code>Enter</code> for each option. »

<syntaxhighlight lang="bash">ssh-keygen -t ed25519 -C "ordi portable vaneau"</syntaxhighlight>
Replace <code>ordi portable vaneau</code> with a name of your choice. You can leave the other fields empty by pressing <code>Enter</code> for each option.

Mettre en place SSH pour Gitlab/en

2026-08-11T11:49:18Z

Daniela.cojocaru : Page créée avec « Open a terminal (cmd or powershell) and type the following command: »

<languages/>
The aim of this guide is to help you set up a computer to use [[GitLab|GitLab]] with SSH authentication. It is aimed at beginners: for a more general introduction, see the main page on [[SSH]] and the BR’s [[Astuces_ssh|advanced tips]].

The installation steps for Windows 10 and 11 are described below. For Linux and macOS, please also refer to the main SSH guide.

The setup is relatively simple. Follow carefully the following steps.
= Prérequis =

Before you start, make sure you have [[Git|git]] installed on your computer. To check this:

* open a cmd or PowerShell terminal (press the Windows key + R, then type <code>cmd</code> or <code>powershell</code>);
* type <code>git -v</code> and check that Git is installed; if it isn’t, [https://git-scm.com/downloads install Git here];
* then type <code>ssh -V</code> to check that SSH is installed; if it isn’t, [https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse install OpenSSH here].

= Mise en place =

== Étape 1 : Générer une clé SSH ==

Open a terminal (cmd or powershell) and type the following command:

<div lang="fr" dir="ltr" class="mw-content-ltr">
<syntaxhighlight lang="bash">ssh-keygen -t ed25519 -C "ordi portable vaneau"</syntaxhighlight>
En remplaçant <code>ordi portable vaneau</code> par un nom de ton choix. Tu peux laisser les autres champs vides en appuyant simplement sur la touche <code>Entrée</code> pour chaque option.
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
À noter qu'il y a une option pour changer le nom de la clé (par défaut <code>id_ed25519</code>) et l’emplacement de sauvegarde. Il y a aussi une autre option pour ajouter un mot de passe (''passphrase'') à la clé, qu'il est recommandé de mettre si ton disque dur n'est pas chiffré.
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
{{Attention|Cette commande génère deux fichiers dans le dossier <code>C:\Users\<ton_nom>\.ssh</code> : la clé privée (<code>id_ed25519</code>) et la clé publique (<code>id_ed25519.pub</code>). '''IL NE FAUT EN AUCUN CAS PARTAGER LA CLÉ PRIVÉE'''. C’est la '''clé publique''' qui doit être ajoutée sur Gitlab. On n’insistera jamais assez sur ce point. Toute la sécurité repose sur le fait que la clé privée reste secrète.}}
</div>

== Étape 2 : Ajouter la clé SSH sur Gitlab ==

# Connecte-toi sur Gitlab avec tes identifiants Sigma BR ;
# Clique sur ton avatar en haut à gauche, puis sur <code>Preferences</code>, puis sur <code>SSH Keys</code> (ou va directement sur [https://gitlab.binets.fr/-/user_settings/ssh_keys cette page]) ;
# Clique sur <code>Add new key</code> ;
# Copie le contenu du fichier <code>C:\Users\<ton_nom>\.ssh\id_ed25519.pub</code> (ou un autre chemin si tu as choisi un autre emplacement) en remplaçant <code><ton_nom></code> par ton nom d’utilisateur Windows et colle-le dans le champ <code>Key</code> ;
# (optionnel) Supprime la date d’expiration de la clé si tu veux qu’elle reste valide indéfiniment ;
# Clique sur <code>Add key</code>.

== Étape 3 : Préparer SSH pour utiliser la clé ==

# Ouvre le dossier <code>C:\Users\<ton_nom>\.ssh</code> sur VSCode (ou ton éditeur de texte préféré) ;
# Crée un fichier <code>config</code> ('''sans extension''') ;
# Ajoute le contenu suivant :

Host gitlab.binets.fr
User git
IdentityFile C:\Users\<ton_nom>\.ssh\id_ed25519

En remplaçant <code><ton_nom></code> par ton nom d’utilisateur Windows.

== Étape 4 : Activer l'agent SSH ==

Taper <code>ssh-add -L</code>
* Si ta clef ssh est affichée, tout va bien, tu peux passer à l'étape suivante
* Sinon, suit ces étapes :

=== Sur windows ===

# Aller dans la recherche windows et lancer <code>Services</code>
# Chercher OpenSSH Authentification Agent
# Double cliquer dessus et mettre : <code>Type de démarrage : Automatique</code>
# Appuyer sur démarrer
# Dans un terminal, faire <code>ssh-add</code>

=== Sur Linux/Mac ===

Voilà une solution un peu nulle qu'il faudra refaire à chaque fois que tu redémarre ton ordi. Lance un terminal et tape :

eval `ssh-agent`
ssh-add

N'hésite pas à trouver une meilleure solution et à l'écrire ici.

== Étape 5 : Tester la connexion SSH ==

Pour tester la connexion SSH, ouvre un terminal et tape la commande suivante :

<syntaxhighlight lang="bash">ssh -T gitlab.binets.fr</syntaxhighlight>
Tu devrais voir un message comme ça :

The authenticity of host 'gitlab.binets.fr (129.104.201.46)' can't be established.
ED25519 key fingerprint is SHA256:sn+wsip9OTBcwiY0ZplULWXNij3v3kdj/tP228i2+70.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Écrit <code>yes</code> puis appuie sur <code>Entrée</code>.

Si tout s’est bien passé, tu devrais voir un message de bienvenue de Gitlab. Dans le cas contraire, vérifie que tu as bien suivi toutes les étapes précédentes. Si tu rencontres des difficultés, n’hésite pas à demander de l’aide au Binet Réseau en permanence ou sur PaniX.

== Étape 6 : Configurer l’identité Git ==

Pour finir, il faut configurer correctement ton identité sur Git. Dans ton terminal, tape les commandes suivantes :

<syntaxhighlight lang="bash">git config --global user.name "<Ton Nom>"
git config --global user.email "<ton.nom>@polytechnique.edu"</syntaxhighlight>
En remplaçant <code><Ton Nom></code> par ton nom et <code><ton.nom>@polytechnique.edu</code> par les valeurs adéquates.

Félicitations ! À partir de là, tu peux utiliser Gitlab avec une authentification SSH.

'''Lorsque tu clones un dépôt, veille bien à choisir le lien SSH et non HTTPS.'''

Translations:Mettre en place SSH pour Gitlab/6/en

2026-08-11T11:49:15Z

Daniela.cojocaru : Page créée avec « Open a terminal (cmd or powershell) and type the following command: »

Open a terminal (cmd or powershell) and type the following command:

Mettre en place SSH pour Gitlab/en

2026-08-11T11:48:56Z

Daniela.cojocaru : Page créée avec « * open a cmd or PowerShell terminal (press the Windows key + R, then type <code>cmd</code> or <code>powershell</code>); * type <code>git -v</code> and check that Git is installed; if it isn’t, [https://git-scm.com/downloads install Git here]; * then type <code>ssh -V</code> to check that SSH is installed; if it isn’t, [https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse install OpenSSH here]. »

<languages/>
The aim of this guide is to help you set up a computer to use [[GitLab|GitLab]] with SSH authentication. It is aimed at beginners: for a more general introduction, see the main page on [[SSH]] and the BR’s [[Astuces_ssh|advanced tips]].

The installation steps for Windows 10 and 11 are described below. For Linux and macOS, please also refer to the main SSH guide.

The setup is relatively simple. Follow carefully the following steps.
= Prérequis =

Before you start, make sure you have [[Git|git]] installed on your computer. To check this:

* open a cmd or PowerShell terminal (press the Windows key + R, then type <code>cmd</code> or <code>powershell</code>);
* type <code>git -v</code> and check that Git is installed; if it isn’t, [https://git-scm.com/downloads install Git here];
* then type <code>ssh -V</code> to check that SSH is installed; if it isn’t, [https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse install OpenSSH here].

= Mise en place =

== Étape 1 : Générer une clé SSH ==

<div lang="fr" dir="ltr" class="mw-content-ltr">
Ouvre un terminal (cmd ou powershell) et tape la commande suivante :
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
<syntaxhighlight lang="bash">ssh-keygen -t ed25519 -C "ordi portable vaneau"</syntaxhighlight>
En remplaçant <code>ordi portable vaneau</code> par un nom de ton choix. Tu peux laisser les autres champs vides en appuyant simplement sur la touche <code>Entrée</code> pour chaque option.
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
À noter qu'il y a une option pour changer le nom de la clé (par défaut <code>id_ed25519</code>) et l’emplacement de sauvegarde. Il y a aussi une autre option pour ajouter un mot de passe (''passphrase'') à la clé, qu'il est recommandé de mettre si ton disque dur n'est pas chiffré.
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
{{Attention|Cette commande génère deux fichiers dans le dossier <code>C:\Users\<ton_nom>\.ssh</code> : la clé privée (<code>id_ed25519</code>) et la clé publique (<code>id_ed25519.pub</code>). '''IL NE FAUT EN AUCUN CAS PARTAGER LA CLÉ PRIVÉE'''. C’est la '''clé publique''' qui doit être ajoutée sur Gitlab. On n’insistera jamais assez sur ce point. Toute la sécurité repose sur le fait que la clé privée reste secrète.}}
</div>

== Étape 2 : Ajouter la clé SSH sur Gitlab ==

# Connecte-toi sur Gitlab avec tes identifiants Sigma BR ;
# Clique sur ton avatar en haut à gauche, puis sur <code>Preferences</code>, puis sur <code>SSH Keys</code> (ou va directement sur [https://gitlab.binets.fr/-/user_settings/ssh_keys cette page]) ;
# Clique sur <code>Add new key</code> ;
# Copie le contenu du fichier <code>C:\Users\<ton_nom>\.ssh\id_ed25519.pub</code> (ou un autre chemin si tu as choisi un autre emplacement) en remplaçant <code><ton_nom></code> par ton nom d’utilisateur Windows et colle-le dans le champ <code>Key</code> ;
# (optionnel) Supprime la date d’expiration de la clé si tu veux qu’elle reste valide indéfiniment ;
# Clique sur <code>Add key</code>.

== Étape 3 : Préparer SSH pour utiliser la clé ==

# Ouvre le dossier <code>C:\Users\<ton_nom>\.ssh</code> sur VSCode (ou ton éditeur de texte préféré) ;
# Crée un fichier <code>config</code> ('''sans extension''') ;
# Ajoute le contenu suivant :

Host gitlab.binets.fr
User git
IdentityFile C:\Users\<ton_nom>\.ssh\id_ed25519

En remplaçant <code><ton_nom></code> par ton nom d’utilisateur Windows.

== Étape 4 : Activer l'agent SSH ==

Taper <code>ssh-add -L</code>
* Si ta clef ssh est affichée, tout va bien, tu peux passer à l'étape suivante
* Sinon, suit ces étapes :

=== Sur windows ===

# Aller dans la recherche windows et lancer <code>Services</code>
# Chercher OpenSSH Authentification Agent
# Double cliquer dessus et mettre : <code>Type de démarrage : Automatique</code>
# Appuyer sur démarrer
# Dans un terminal, faire <code>ssh-add</code>

=== Sur Linux/Mac ===

Voilà une solution un peu nulle qu'il faudra refaire à chaque fois que tu redémarre ton ordi. Lance un terminal et tape :

eval `ssh-agent`
ssh-add

N'hésite pas à trouver une meilleure solution et à l'écrire ici.

== Étape 5 : Tester la connexion SSH ==

Pour tester la connexion SSH, ouvre un terminal et tape la commande suivante :

<syntaxhighlight lang="bash">ssh -T gitlab.binets.fr</syntaxhighlight>
Tu devrais voir un message comme ça :

The authenticity of host 'gitlab.binets.fr (129.104.201.46)' can't be established.
ED25519 key fingerprint is SHA256:sn+wsip9OTBcwiY0ZplULWXNij3v3kdj/tP228i2+70.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Écrit <code>yes</code> puis appuie sur <code>Entrée</code>.

Si tout s’est bien passé, tu devrais voir un message de bienvenue de Gitlab. Dans le cas contraire, vérifie que tu as bien suivi toutes les étapes précédentes. Si tu rencontres des difficultés, n’hésite pas à demander de l’aide au Binet Réseau en permanence ou sur PaniX.

== Étape 6 : Configurer l’identité Git ==

Pour finir, il faut configurer correctement ton identité sur Git. Dans ton terminal, tape les commandes suivantes :

<syntaxhighlight lang="bash">git config --global user.name "<Ton Nom>"
git config --global user.email "<ton.nom>@polytechnique.edu"</syntaxhighlight>
En remplaçant <code><Ton Nom></code> par ton nom et <code><ton.nom>@polytechnique.edu</code> par les valeurs adéquates.

Félicitations ! À partir de là, tu peux utiliser Gitlab avec une authentification SSH.

'''Lorsque tu clones un dépôt, veille bien à choisir le lien SSH et non HTTPS.'''

Translations:Mettre en place SSH pour Gitlab/5/en

2026-08-11T11:48:54Z

* open a cmd or PowerShell terminal (press the Windows key + R, then type <code>cmd</code> or <code>powershell</code>);
* type <code>git -v</code> and check that Git is installed; if it isn’t, [https://git-scm.com/downloads install Git here];
* then type <code>ssh -V</code> to check that SSH is installed; if it isn’t, [https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse install OpenSSH here].

Mettre en place SSH pour Gitlab/en

2026-08-11T11:47:54Z

Daniela.cojocaru : Page créée avec « Before you start, make sure you have git installed on your computer. To check this: »

<languages/>
The aim of this guide is to help you set up a computer to use [[GitLab|GitLab]] with SSH authentication. It is aimed at beginners: for a more general introduction, see the main page on [[SSH]] and the BR’s [[Astuces_ssh|advanced tips]].

The installation steps for Windows 10 and 11 are described below. For Linux and macOS, please also refer to the main SSH guide.

The setup is relatively simple. Follow carefully the following steps.
= Prérequis =

Before you start, make sure you have [[Git|git]] installed on your computer. To check this:

<div lang="fr" dir="ltr" class="mw-content-ltr">
* ouvrir un terminal cmd ou powershell (touche Windows + R, puis taper <code>cmd</code> ou <code>powershell</code>) ;
* taper <code>git -v</code> et vérifier que git est bien installé et, si ce n’est pas le cas, [https://git-scm.com/downloads installe git ici] ;
* taper ensuite <code>ssh -V</code> pour vérifier que ssh est installé et, si ce n’est pas le cas, [https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse installe OpenSSH ici].
</div>

= Mise en place =

== Étape 1 : Générer une clé SSH ==

<div lang="fr" dir="ltr" class="mw-content-ltr">
Ouvre un terminal (cmd ou powershell) et tape la commande suivante :
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
<syntaxhighlight lang="bash">ssh-keygen -t ed25519 -C "ordi portable vaneau"</syntaxhighlight>
En remplaçant <code>ordi portable vaneau</code> par un nom de ton choix. Tu peux laisser les autres champs vides en appuyant simplement sur la touche <code>Entrée</code> pour chaque option.
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
À noter qu'il y a une option pour changer le nom de la clé (par défaut <code>id_ed25519</code>) et l’emplacement de sauvegarde. Il y a aussi une autre option pour ajouter un mot de passe (''passphrase'') à la clé, qu'il est recommandé de mettre si ton disque dur n'est pas chiffré.
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
{{Attention|Cette commande génère deux fichiers dans le dossier <code>C:\Users\<ton_nom>\.ssh</code> : la clé privée (<code>id_ed25519</code>) et la clé publique (<code>id_ed25519.pub</code>). '''IL NE FAUT EN AUCUN CAS PARTAGER LA CLÉ PRIVÉE'''. C’est la '''clé publique''' qui doit être ajoutée sur Gitlab. On n’insistera jamais assez sur ce point. Toute la sécurité repose sur le fait que la clé privée reste secrète.}}
</div>

== Étape 2 : Ajouter la clé SSH sur Gitlab ==

# Connecte-toi sur Gitlab avec tes identifiants Sigma BR ;
# Clique sur ton avatar en haut à gauche, puis sur <code>Preferences</code>, puis sur <code>SSH Keys</code> (ou va directement sur [https://gitlab.binets.fr/-/user_settings/ssh_keys cette page]) ;
# Clique sur <code>Add new key</code> ;
# Copie le contenu du fichier <code>C:\Users\<ton_nom>\.ssh\id_ed25519.pub</code> (ou un autre chemin si tu as choisi un autre emplacement) en remplaçant <code><ton_nom></code> par ton nom d’utilisateur Windows et colle-le dans le champ <code>Key</code> ;
# (optionnel) Supprime la date d’expiration de la clé si tu veux qu’elle reste valide indéfiniment ;
# Clique sur <code>Add key</code>.

== Étape 3 : Préparer SSH pour utiliser la clé ==

# Ouvre le dossier <code>C:\Users\<ton_nom>\.ssh</code> sur VSCode (ou ton éditeur de texte préféré) ;
# Crée un fichier <code>config</code> ('''sans extension''') ;
# Ajoute le contenu suivant :

Host gitlab.binets.fr
User git
IdentityFile C:\Users\<ton_nom>\.ssh\id_ed25519

En remplaçant <code><ton_nom></code> par ton nom d’utilisateur Windows.

== Étape 4 : Activer l'agent SSH ==

Taper <code>ssh-add -L</code>
* Si ta clef ssh est affichée, tout va bien, tu peux passer à l'étape suivante
* Sinon, suit ces étapes :

=== Sur windows ===

# Aller dans la recherche windows et lancer <code>Services</code>
# Chercher OpenSSH Authentification Agent
# Double cliquer dessus et mettre : <code>Type de démarrage : Automatique</code>
# Appuyer sur démarrer
# Dans un terminal, faire <code>ssh-add</code>

=== Sur Linux/Mac ===

Voilà une solution un peu nulle qu'il faudra refaire à chaque fois que tu redémarre ton ordi. Lance un terminal et tape :

eval `ssh-agent`
ssh-add

N'hésite pas à trouver une meilleure solution et à l'écrire ici.

== Étape 5 : Tester la connexion SSH ==

Pour tester la connexion SSH, ouvre un terminal et tape la commande suivante :

<syntaxhighlight lang="bash">ssh -T gitlab.binets.fr</syntaxhighlight>
Tu devrais voir un message comme ça :

The authenticity of host 'gitlab.binets.fr (129.104.201.46)' can't be established.
ED25519 key fingerprint is SHA256:sn+wsip9OTBcwiY0ZplULWXNij3v3kdj/tP228i2+70.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Écrit <code>yes</code> puis appuie sur <code>Entrée</code>.

Si tout s’est bien passé, tu devrais voir un message de bienvenue de Gitlab. Dans le cas contraire, vérifie que tu as bien suivi toutes les étapes précédentes. Si tu rencontres des difficultés, n’hésite pas à demander de l’aide au Binet Réseau en permanence ou sur PaniX.

== Étape 6 : Configurer l’identité Git ==

Pour finir, il faut configurer correctement ton identité sur Git. Dans ton terminal, tape les commandes suivantes :

<syntaxhighlight lang="bash">git config --global user.name "<Ton Nom>"
git config --global user.email "<ton.nom>@polytechnique.edu"</syntaxhighlight>
En remplaçant <code><Ton Nom></code> par ton nom et <code><ton.nom>@polytechnique.edu</code> par les valeurs adéquates.

Félicitations ! À partir de là, tu peux utiliser Gitlab avec une authentification SSH.

'''Lorsque tu clones un dépôt, veille bien à choisir le lien SSH et non HTTPS.'''

Translations:Mettre en place SSH pour Gitlab/4/en

2026-08-11T11:47:49Z

Daniela.cojocaru : Page créée avec « Before you start, make sure you have git installed on your computer. To check this: »

Before you start, make sure you have [[Git|git]] installed on your computer. To check this:

Mettre en place SSH pour Gitlab/en

2026-08-11T11:47:20Z

Daniela.cojocaru : Page créée avec « The setup is relatively simple. Follow carefully the following steps. »

<languages/>
The aim of this guide is to help you set up a computer to use [[GitLab|GitLab]] with SSH authentication. It is aimed at beginners: for a more general introduction, see the main page on [[SSH]] and the BR’s [[Astuces_ssh|advanced tips]].

The installation steps for Windows 10 and 11 are described below. For Linux and macOS, please also refer to the main SSH guide.

The setup is relatively simple. Follow carefully the following steps.
= Prérequis =

<div lang="fr" dir="ltr" class="mw-content-ltr">
Avant de commencer, assure-toi d’avoir [[Git|git]] installé sur ta machine. Pour vérifier cela :
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
* ouvrir un terminal cmd ou powershell (touche Windows + R, puis taper <code>cmd</code> ou <code>powershell</code>) ;
* taper <code>git -v</code> et vérifier que git est bien installé et, si ce n’est pas le cas, [https://git-scm.com/downloads installe git ici] ;
* taper ensuite <code>ssh -V</code> pour vérifier que ssh est installé et, si ce n’est pas le cas, [https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse installe OpenSSH ici].
</div>

= Mise en place =

== Étape 1 : Générer une clé SSH ==

<div lang="fr" dir="ltr" class="mw-content-ltr">
Ouvre un terminal (cmd ou powershell) et tape la commande suivante :
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
<syntaxhighlight lang="bash">ssh-keygen -t ed25519 -C "ordi portable vaneau"</syntaxhighlight>
En remplaçant <code>ordi portable vaneau</code> par un nom de ton choix. Tu peux laisser les autres champs vides en appuyant simplement sur la touche <code>Entrée</code> pour chaque option.
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
À noter qu'il y a une option pour changer le nom de la clé (par défaut <code>id_ed25519</code>) et l’emplacement de sauvegarde. Il y a aussi une autre option pour ajouter un mot de passe (''passphrase'') à la clé, qu'il est recommandé de mettre si ton disque dur n'est pas chiffré.
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
{{Attention|Cette commande génère deux fichiers dans le dossier <code>C:\Users\<ton_nom>\.ssh</code> : la clé privée (<code>id_ed25519</code>) et la clé publique (<code>id_ed25519.pub</code>). '''IL NE FAUT EN AUCUN CAS PARTAGER LA CLÉ PRIVÉE'''. C’est la '''clé publique''' qui doit être ajoutée sur Gitlab. On n’insistera jamais assez sur ce point. Toute la sécurité repose sur le fait que la clé privée reste secrète.}}
</div>

== Étape 2 : Ajouter la clé SSH sur Gitlab ==

# Connecte-toi sur Gitlab avec tes identifiants Sigma BR ;
# Clique sur ton avatar en haut à gauche, puis sur <code>Preferences</code>, puis sur <code>SSH Keys</code> (ou va directement sur [https://gitlab.binets.fr/-/user_settings/ssh_keys cette page]) ;
# Clique sur <code>Add new key</code> ;
# Copie le contenu du fichier <code>C:\Users\<ton_nom>\.ssh\id_ed25519.pub</code> (ou un autre chemin si tu as choisi un autre emplacement) en remplaçant <code><ton_nom></code> par ton nom d’utilisateur Windows et colle-le dans le champ <code>Key</code> ;
# (optionnel) Supprime la date d’expiration de la clé si tu veux qu’elle reste valide indéfiniment ;
# Clique sur <code>Add key</code>.

== Étape 3 : Préparer SSH pour utiliser la clé ==

# Ouvre le dossier <code>C:\Users\<ton_nom>\.ssh</code> sur VSCode (ou ton éditeur de texte préféré) ;
# Crée un fichier <code>config</code> ('''sans extension''') ;
# Ajoute le contenu suivant :

Host gitlab.binets.fr
User git
IdentityFile C:\Users\<ton_nom>\.ssh\id_ed25519

En remplaçant <code><ton_nom></code> par ton nom d’utilisateur Windows.

== Étape 4 : Activer l'agent SSH ==

Taper <code>ssh-add -L</code>
* Si ta clef ssh est affichée, tout va bien, tu peux passer à l'étape suivante
* Sinon, suit ces étapes :

=== Sur windows ===

# Aller dans la recherche windows et lancer <code>Services</code>
# Chercher OpenSSH Authentification Agent
# Double cliquer dessus et mettre : <code>Type de démarrage : Automatique</code>
# Appuyer sur démarrer
# Dans un terminal, faire <code>ssh-add</code>

=== Sur Linux/Mac ===

Voilà une solution un peu nulle qu'il faudra refaire à chaque fois que tu redémarre ton ordi. Lance un terminal et tape :

eval `ssh-agent`
ssh-add

N'hésite pas à trouver une meilleure solution et à l'écrire ici.

== Étape 5 : Tester la connexion SSH ==

Pour tester la connexion SSH, ouvre un terminal et tape la commande suivante :

<syntaxhighlight lang="bash">ssh -T gitlab.binets.fr</syntaxhighlight>
Tu devrais voir un message comme ça :

The authenticity of host 'gitlab.binets.fr (129.104.201.46)' can't be established.
ED25519 key fingerprint is SHA256:sn+wsip9OTBcwiY0ZplULWXNij3v3kdj/tP228i2+70.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Écrit <code>yes</code> puis appuie sur <code>Entrée</code>.

Si tout s’est bien passé, tu devrais voir un message de bienvenue de Gitlab. Dans le cas contraire, vérifie que tu as bien suivi toutes les étapes précédentes. Si tu rencontres des difficultés, n’hésite pas à demander de l’aide au Binet Réseau en permanence ou sur PaniX.

== Étape 6 : Configurer l’identité Git ==

Pour finir, il faut configurer correctement ton identité sur Git. Dans ton terminal, tape les commandes suivantes :

<syntaxhighlight lang="bash">git config --global user.name "<Ton Nom>"
git config --global user.email "<ton.nom>@polytechnique.edu"</syntaxhighlight>
En remplaçant <code><Ton Nom></code> par ton nom et <code><ton.nom>@polytechnique.edu</code> par les valeurs adéquates.

Félicitations ! À partir de là, tu peux utiliser Gitlab avec une authentification SSH.

'''Lorsque tu clones un dépôt, veille bien à choisir le lien SSH et non HTTPS.'''

Translations:Mettre en place SSH pour Gitlab/3/en

2026-08-11T11:47:13Z

Daniela.cojocaru : Page créée avec « The setup is relatively simple. Follow carefully the following steps. »

The setup is relatively simple. Follow carefully the following steps.

Mettre en place SSH pour Gitlab/en

2026-08-11T11:46:48Z

Daniela.cojocaru : Page créée avec « The installation steps for Windows 10 and 11 are described below. For Linux and macOS, please also refer to the main SSH guide. »

<languages/>
The aim of this guide is to help you set up a computer to use [[GitLab|GitLab]] with SSH authentication. It is aimed at beginners: for a more general introduction, see the main page on [[SSH]] and the BR’s [[Astuces_ssh|advanced tips]].

The installation steps for Windows 10 and 11 are described below. For Linux and macOS, please also refer to the main SSH guide.

<div lang="fr" dir="ltr" class="mw-content-ltr">
La mise en place est relativement simple. Suit scrupuleusement les étapes suivantes.
</div>
= Prérequis =

<div lang="fr" dir="ltr" class="mw-content-ltr">
Avant de commencer, assure-toi d’avoir [[Git|git]] installé sur ta machine. Pour vérifier cela :
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
* ouvrir un terminal cmd ou powershell (touche Windows + R, puis taper <code>cmd</code> ou <code>powershell</code>) ;
* taper <code>git -v</code> et vérifier que git est bien installé et, si ce n’est pas le cas, [https://git-scm.com/downloads installe git ici] ;
* taper ensuite <code>ssh -V</code> pour vérifier que ssh est installé et, si ce n’est pas le cas, [https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse installe OpenSSH ici].
</div>

= Mise en place =

== Étape 1 : Générer une clé SSH ==

<div lang="fr" dir="ltr" class="mw-content-ltr">
Ouvre un terminal (cmd ou powershell) et tape la commande suivante :
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
<syntaxhighlight lang="bash">ssh-keygen -t ed25519 -C "ordi portable vaneau"</syntaxhighlight>
En remplaçant <code>ordi portable vaneau</code> par un nom de ton choix. Tu peux laisser les autres champs vides en appuyant simplement sur la touche <code>Entrée</code> pour chaque option.
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
À noter qu'il y a une option pour changer le nom de la clé (par défaut <code>id_ed25519</code>) et l’emplacement de sauvegarde. Il y a aussi une autre option pour ajouter un mot de passe (''passphrase'') à la clé, qu'il est recommandé de mettre si ton disque dur n'est pas chiffré.
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
{{Attention|Cette commande génère deux fichiers dans le dossier <code>C:\Users\<ton_nom>\.ssh</code> : la clé privée (<code>id_ed25519</code>) et la clé publique (<code>id_ed25519.pub</code>). '''IL NE FAUT EN AUCUN CAS PARTAGER LA CLÉ PRIVÉE'''. C’est la '''clé publique''' qui doit être ajoutée sur Gitlab. On n’insistera jamais assez sur ce point. Toute la sécurité repose sur le fait que la clé privée reste secrète.}}
</div>

== Étape 2 : Ajouter la clé SSH sur Gitlab ==

# Connecte-toi sur Gitlab avec tes identifiants Sigma BR ;
# Clique sur ton avatar en haut à gauche, puis sur <code>Preferences</code>, puis sur <code>SSH Keys</code> (ou va directement sur [https://gitlab.binets.fr/-/user_settings/ssh_keys cette page]) ;
# Clique sur <code>Add new key</code> ;
# Copie le contenu du fichier <code>C:\Users\<ton_nom>\.ssh\id_ed25519.pub</code> (ou un autre chemin si tu as choisi un autre emplacement) en remplaçant <code><ton_nom></code> par ton nom d’utilisateur Windows et colle-le dans le champ <code>Key</code> ;
# (optionnel) Supprime la date d’expiration de la clé si tu veux qu’elle reste valide indéfiniment ;
# Clique sur <code>Add key</code>.

== Étape 3 : Préparer SSH pour utiliser la clé ==

# Ouvre le dossier <code>C:\Users\<ton_nom>\.ssh</code> sur VSCode (ou ton éditeur de texte préféré) ;
# Crée un fichier <code>config</code> ('''sans extension''') ;
# Ajoute le contenu suivant :

Host gitlab.binets.fr
User git
IdentityFile C:\Users\<ton_nom>\.ssh\id_ed25519

En remplaçant <code><ton_nom></code> par ton nom d’utilisateur Windows.

== Étape 4 : Activer l'agent SSH ==

Taper <code>ssh-add -L</code>
* Si ta clef ssh est affichée, tout va bien, tu peux passer à l'étape suivante
* Sinon, suit ces étapes :

=== Sur windows ===

# Aller dans la recherche windows et lancer <code>Services</code>
# Chercher OpenSSH Authentification Agent
# Double cliquer dessus et mettre : <code>Type de démarrage : Automatique</code>
# Appuyer sur démarrer
# Dans un terminal, faire <code>ssh-add</code>

=== Sur Linux/Mac ===

Voilà une solution un peu nulle qu'il faudra refaire à chaque fois que tu redémarre ton ordi. Lance un terminal et tape :

eval `ssh-agent`
ssh-add

N'hésite pas à trouver une meilleure solution et à l'écrire ici.

== Étape 5 : Tester la connexion SSH ==

Pour tester la connexion SSH, ouvre un terminal et tape la commande suivante :

<syntaxhighlight lang="bash">ssh -T gitlab.binets.fr</syntaxhighlight>
Tu devrais voir un message comme ça :

The authenticity of host 'gitlab.binets.fr (129.104.201.46)' can't be established.
ED25519 key fingerprint is SHA256:sn+wsip9OTBcwiY0ZplULWXNij3v3kdj/tP228i2+70.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Écrit <code>yes</code> puis appuie sur <code>Entrée</code>.

Si tout s’est bien passé, tu devrais voir un message de bienvenue de Gitlab. Dans le cas contraire, vérifie que tu as bien suivi toutes les étapes précédentes. Si tu rencontres des difficultés, n’hésite pas à demander de l’aide au Binet Réseau en permanence ou sur PaniX.

== Étape 6 : Configurer l’identité Git ==

Pour finir, il faut configurer correctement ton identité sur Git. Dans ton terminal, tape les commandes suivantes :

<syntaxhighlight lang="bash">git config --global user.name "<Ton Nom>"
git config --global user.email "<ton.nom>@polytechnique.edu"</syntaxhighlight>
En remplaçant <code><Ton Nom></code> par ton nom et <code><ton.nom>@polytechnique.edu</code> par les valeurs adéquates.

Félicitations ! À partir de là, tu peux utiliser Gitlab avec une authentification SSH.

'''Lorsque tu clones un dépôt, veille bien à choisir le lien SSH et non HTTPS.'''

Translations:Mettre en place SSH pour Gitlab/2/en

2026-08-11T11:46:43Z

Daniela.cojocaru : Page créée avec « The installation steps for Windows 10 and 11 are described below. For Linux and macOS, please also refer to the main SSH guide. »

The installation steps for Windows 10 and 11 are described below. For Linux and macOS, please also refer to the main SSH guide.

Mettre en place SSH pour Gitlab/en

2026-08-11T11:46:24Z

Daniela.cojocaru : Page créée avec « The aim of this guide is to help you set up a computer to use GitLab with SSH authentication. It is aimed at beginners: for a more general introduction, see the main page on SSH and the BR’s advanced tips. »

<languages/>
The aim of this guide is to help you set up a computer to use [[GitLab|GitLab]] with SSH authentication. It is aimed at beginners: for a more general introduction, see the main page on [[SSH]] and the BR’s [[Astuces_ssh|advanced tips]].

<div lang="fr" dir="ltr" class="mw-content-ltr">
On décrit les étapes d’installation pour Windows 10 et 11. Pour Linux et macOS, se référer également au guide SSH principal.
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
La mise en place est relativement simple. Suit scrupuleusement les étapes suivantes.
</div>
= Prérequis =

<div lang="fr" dir="ltr" class="mw-content-ltr">
Avant de commencer, assure-toi d’avoir [[Git|git]] installé sur ta machine. Pour vérifier cela :
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
* ouvrir un terminal cmd ou powershell (touche Windows + R, puis taper <code>cmd</code> ou <code>powershell</code>) ;
* taper <code>git -v</code> et vérifier que git est bien installé et, si ce n’est pas le cas, [https://git-scm.com/downloads installe git ici] ;
* taper ensuite <code>ssh -V</code> pour vérifier que ssh est installé et, si ce n’est pas le cas, [https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse installe OpenSSH ici].
</div>

= Mise en place =

== Étape 1 : Générer une clé SSH ==

<div lang="fr" dir="ltr" class="mw-content-ltr">
Ouvre un terminal (cmd ou powershell) et tape la commande suivante :
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
<syntaxhighlight lang="bash">ssh-keygen -t ed25519 -C "ordi portable vaneau"</syntaxhighlight>
En remplaçant <code>ordi portable vaneau</code> par un nom de ton choix. Tu peux laisser les autres champs vides en appuyant simplement sur la touche <code>Entrée</code> pour chaque option.
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
À noter qu'il y a une option pour changer le nom de la clé (par défaut <code>id_ed25519</code>) et l’emplacement de sauvegarde. Il y a aussi une autre option pour ajouter un mot de passe (''passphrase'') à la clé, qu'il est recommandé de mettre si ton disque dur n'est pas chiffré.
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
{{Attention|Cette commande génère deux fichiers dans le dossier <code>C:\Users\<ton_nom>\.ssh</code> : la clé privée (<code>id_ed25519</code>) et la clé publique (<code>id_ed25519.pub</code>). '''IL NE FAUT EN AUCUN CAS PARTAGER LA CLÉ PRIVÉE'''. C’est la '''clé publique''' qui doit être ajoutée sur Gitlab. On n’insistera jamais assez sur ce point. Toute la sécurité repose sur le fait que la clé privée reste secrète.}}
</div>

== Étape 2 : Ajouter la clé SSH sur Gitlab ==

# Connecte-toi sur Gitlab avec tes identifiants Sigma BR ;
# Clique sur ton avatar en haut à gauche, puis sur <code>Preferences</code>, puis sur <code>SSH Keys</code> (ou va directement sur [https://gitlab.binets.fr/-/user_settings/ssh_keys cette page]) ;
# Clique sur <code>Add new key</code> ;
# Copie le contenu du fichier <code>C:\Users\<ton_nom>\.ssh\id_ed25519.pub</code> (ou un autre chemin si tu as choisi un autre emplacement) en remplaçant <code><ton_nom></code> par ton nom d’utilisateur Windows et colle-le dans le champ <code>Key</code> ;
# (optionnel) Supprime la date d’expiration de la clé si tu veux qu’elle reste valide indéfiniment ;
# Clique sur <code>Add key</code>.

== Étape 3 : Préparer SSH pour utiliser la clé ==

# Ouvre le dossier <code>C:\Users\<ton_nom>\.ssh</code> sur VSCode (ou ton éditeur de texte préféré) ;
# Crée un fichier <code>config</code> ('''sans extension''') ;
# Ajoute le contenu suivant :

Host gitlab.binets.fr
User git
IdentityFile C:\Users\<ton_nom>\.ssh\id_ed25519

En remplaçant <code><ton_nom></code> par ton nom d’utilisateur Windows.

== Étape 4 : Activer l'agent SSH ==

Taper <code>ssh-add -L</code>
* Si ta clef ssh est affichée, tout va bien, tu peux passer à l'étape suivante
* Sinon, suit ces étapes :

=== Sur windows ===

# Aller dans la recherche windows et lancer <code>Services</code>
# Chercher OpenSSH Authentification Agent
# Double cliquer dessus et mettre : <code>Type de démarrage : Automatique</code>
# Appuyer sur démarrer
# Dans un terminal, faire <code>ssh-add</code>

=== Sur Linux/Mac ===

Voilà une solution un peu nulle qu'il faudra refaire à chaque fois que tu redémarre ton ordi. Lance un terminal et tape :

eval `ssh-agent`
ssh-add

N'hésite pas à trouver une meilleure solution et à l'écrire ici.

== Étape 5 : Tester la connexion SSH ==

Pour tester la connexion SSH, ouvre un terminal et tape la commande suivante :

<syntaxhighlight lang="bash">ssh -T gitlab.binets.fr</syntaxhighlight>
Tu devrais voir un message comme ça :

The authenticity of host 'gitlab.binets.fr (129.104.201.46)' can't be established.
ED25519 key fingerprint is SHA256:sn+wsip9OTBcwiY0ZplULWXNij3v3kdj/tP228i2+70.
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Écrit <code>yes</code> puis appuie sur <code>Entrée</code>.

Si tout s’est bien passé, tu devrais voir un message de bienvenue de Gitlab. Dans le cas contraire, vérifie que tu as bien suivi toutes les étapes précédentes. Si tu rencontres des difficultés, n’hésite pas à demander de l’aide au Binet Réseau en permanence ou sur PaniX.

== Étape 6 : Configurer l’identité Git ==

Pour finir, il faut configurer correctement ton identité sur Git. Dans ton terminal, tape les commandes suivantes :

<syntaxhighlight lang="bash">git config --global user.name "<Ton Nom>"
git config --global user.email "<ton.nom>@polytechnique.edu"</syntaxhighlight>
En remplaçant <code><Ton Nom></code> par ton nom et <code><ton.nom>@polytechnique.edu</code> par les valeurs adéquates.

Félicitations ! À partir de là, tu peux utiliser Gitlab avec une authentification SSH.

'''Lorsque tu clones un dépôt, veille bien à choisir le lien SSH et non HTTPS.'''

Translations:Mettre en place SSH pour Gitlab/1/en

2026-08-11T11:46:23Z

The aim of this guide is to help you set up a computer to use [[GitLab|GitLab]] with SSH authentication. It is aimed at beginners: for a more general introduction, see the main page on [[SSH]] and the BR’s [[Astuces_ssh|advanced tips]].

Translations:Mettre en place SSH pour Gitlab/Page display title/en

2026-08-11T11:45:28Z

Daniela.cojocaru : Page créée avec « Configuring SSH for Gitlab »

Configuring SSH for Gitlab

Tuto pour le déploiement des sites avec Docker/en

2026-08-05T13:41:08Z

Daniela.cojocaru : Page créée avec « Now, you need to make ''your'' app work in the docker container. For this, you need: »

At the end of this tutorial you will be able to deploy your website (or service) on the servers of the BR! This allows you to benefit from a free, high-performance and robust infrastructure!

Note: this tutorial may be a bit tricky, so please don’t hesitate to get in touch with a BRman to get help.

<span id="Comment_déployer_des_conteneurs_Docker_sur_l'infrastructure_du_BR"></span>
= How to deploy Docker containers on the infrastructure of the BR =

== Overview ==

This tutorial will walk you through :
* How to convert your website to a Docker service
* How to build it automatically on Gitlab-CI
* How to deploy it automatically on our servers

== Requirements ==

* Basics of git (videos [https://git-scm.com/video/what-is-version-control here] or the beginning of [https://git-scm.com/book/en/v2 this awesome online book]) ;
* Basics of containers (see a really good explanation [https://www.docker.com/resources/what-container here]) and of docker-compose (see the getting-started [https://docs.docker.com/compose/gettingstarted/ here]) ;
* Basics of web (see an [https://developer.mozilla.org/en-US/docs/Learn/Getting_started_with_the_web/How_the_Web_works introduction] on MDN) ;
* Basics of gitlab-ci (reading the [https://docs.gitlab.com/ee/ci/ getting-started] is recommended) ;

== Existing architecture ==

A physical server called <code>endalcher</code> deploys and runs your container. It uses the following services to connect your service to the Interne:

* [https://docs.docker.com/compose/ docker-compose] to deploy the correct environment for your containers ;
* [https://docs.traefik.io/v1.7/ traefik] as a reverse proxy to serve your site behind your endpoint, it is configured [https://gitlab.binets.fr/br/docker-default-services here] ;
* nginx to serve your site to the outside world (as all the binets sites).

== How to convert your website to a Docker service ==

The exact procedure will be dependant on your project. An example can be found here : [https://gitlab.binets.fr/br/qdj/-/blob/master/deployment/Dockerfile?ref_type=heads qdj-Dockerfile]

A ''Docker container'' is an isolated machine on which you can run your website. In this step, we will help you convert you app to be Docker-ready. This basically means installing everything your app needs inside a linux computer. You'll need to install ''Docker'' on your computer first [https://docs.docker.com/desktop/install/windows-install/ windows-installer].

We assume your project is hosted on the [https://gitlab.binets.fr BR's gitlab instance]. Create a <code>deployment</code> directory at the root of your repository and create a file <code>Dockerfile</code> (with no extension) and a file <code>docker-compose.yaml</code> in it.

* Dockerfile
<source lang="yaml">
FROM hello-world
</source>

* docker-compose.yaml
<source lang="yaml">
# this is a docker-compose meant for local testing of the deployment image.
# for the real deployment, go to the docker-services BR gitlab project

version: "3"
services:
app:
build:
context: ..
dockerfile: deployment/Dockerfile
# ports:
# - "8000:8000"
</source>

Then open a terminal in this directory and type <code>docker compose up --build</code>. If everything went well, you see a nice message from Docker telling you everything is working!

Now, you need to make ''your'' app work in the docker container. For this, you need:

* To update the Dockerfile to install everything you need. The following works for a basic (Django) python app :
<source>
FROM python:3

# copies all the code inside the container
COPY . /my_super_project

WORKDIR /my_super_project
RUN pip install --no-cache-dir -r requirements.txt
CMD python3 manage.py runserver
</source>

* To update the docker-compose file to expose the port you need (uncomment the corresponding line in the dockerfile).

=== How to handle persistant data ===

If you app uses an external database or need to not lose some files accross resets, you should use ''docker volumes'' with or without a ''postgres'' image. The [https://gitlab.binets.fr/br/docker-services/-/blob/master/docker-compose.site-jtx.yml?ref_type=heads jtx-docker-compose] might help you understand what you need.

=== How to handle secrets ===

Often your app has some secrets in a file (such as ''.env'') that is not in Git. DO NOT put it in git (or all your secrets will be stolen !). Later we are going to see how to securely make them available for the automatic gitlab build.

== Automatic build ==

We will you ''gitlab continuous integration'' to build your docker image directly on the BR's servers. Write the following into a file name <code>.gitlab-ci.yml</code> at the root of your repository :

<source lang="yaml"># Build docker image and upload to registry
variables:
IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_PIPELINE_IID
PROJECT: mySuperProject

docker:build:
stage: build
only: # put here the git branches you want the job to run on :
- main
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
DOCKER_TLS_CERTDIR: '' # disables TLS in docker-in-docker (not needed)
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG
</source>

As you commit this file to Gitlab, you should see a new job appear (or look under Build/jobs). Your image should build correctly (if not, it means something is not available to gitlab that is when you build on your computer. Read the job logs and try to fix it !)

=== Checking the image ===

This step is optional, but it is the easiest way to debug your image ! You can run it locally like so :

<source lang=bash>
docker login registry.binets.fr
docker run --rm registry.binets.fr/<nom.prenom>/<my-gitlab-repo>:<image>
</source>

Where <code>image</code> is the number of the image (available in <code>Gitlab -> Deploy -> Container registry</code>) and <code><nom.prenom>/<my-gitlab-repo></code> is the same as in your project Gitlab URL.

Typically, your app won't start because you forgot a secret file (see below how to manage that !).

== Automatic deployment ==

We will now add a second CI job to your repository to deploy your image. It will trigger ''another'' CI pipeline of [https://gitlab.binets.fr/br/docker-services br/docker-services]. This pipeline has the rights to deploy on <code>endalcher</code>, and does so using a <code>docker-compose.yaml</code> file. To trigger it, add the following to your <code>.gitlab-ci.yml</code>

<source lang=yaml>
docker:deploy:
stage: deploy
only:
- stable
image: debian:latest
when: manual
script:
- apt-get update && apt-get install -y curl
- curl --fail-with-body --request POST --form token=$TRIGGER_TOKEN --form ref=master --form variables[PROJECT]=$PROJECT --form variables[DOCKER_IMAGE]=$IMAGE_TAG https://gitlab.binets.fr/api/v4/projects/560/trigger/pipeline
</source>

Make sure the variable <code>PROJECT</code> in <code>.gitlab-ci.yml</code> is correct : our pipeline will deploy the file named <code>docker-compose.${PROJECT}.yaml</code>.

In order to create the correct <code>docker-compose.${PROJECT}.yaml</code> file, you will need to create a Merge Request on [https://gitlab.binets.fr/br/docker-services br/docker-services], or send a <code>docker-compose.yaml</code> file to a BRman. The [https://gitlab.binets.fr/br/docker-services br/docker-services] is full of examples and a basic one is explained below :

=== Extra parameters and secrets ===

''Be aware that any secret passed this way is still visible to the BR and everyone that has maintainer access to you repository ! If you need help setting up, don't hesitate to ask for help from the BR !''

You can also pass any parameter needed in the compose file by adding arguments to the cURL call like so : <code>--form variables[MY_SUPER_VARIABLE]="elle vaut 42!"</code>

If you want to pass secret environnements variables, store them in <code>Gitlab -> Settings -> CI-CD -> Variables</code> and make sure they are "protected" and "masked". Pass them like so <code>--form variables[MY_PASSWORD]=$PASSWORD_STORED_IN_GITLAB</code>.

=== Secret files ===

''Be aware that any secret passed this way too is visible to the BR and everyone that has ''ANY'' access to you repository (because they can get the docker image) ! So only do this for a private registry or make sure your setting <code>Settings -> General -> Visibility, project features, permissions</code> only allows for registry access for members''

Another way to store secrets in your Gitlab repo is <code>Gitlab -> Settings -> CI-CD -> Secure-files</code>. You can upload any (small) secret file here and it will not be exposed ! You can downlod it at buildtime like so :

<source lang=yaml>
# Build docker image and upload to registry
docker:build:
stage: build
only:
- main
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
# For disabling TLS in docker-in-docker (not needed)
DOCKER_TLS_CERTDIR: ""
# !!! where to download our secure .env file
SECURE_FILES_DOWNLOAD_PATH: "."
script:
# !!! download secure .env file
- apk add --no-cache curl bash
- curl --silent "https://gitlab.com/gitlab-org/incubation-engineering/mobile-devops/download-secure-files/-/raw/main/installer" | bash
# build docker image
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG
- echo "=> pushed $IMAGE_TAG"
</source>

=== Private repository ===

Keeping your repository private can be beneficial for security or privacy. But it require an extra step for the BR to access the docker image. We wille pass a [https://docs.gitlab.com/ee/user/project/deploy_tokens/#gitlab-deploy-token CI deploy token] as cURL parameter.

* Go to your <code>Settings -> Repository -> Deploy token</code> and create a token name exactly <code>gitlab-deploy-token</code>

* Add the following parameters to the cURL call in your CI deploy job : <code> --form variables[OPTIONAL_PRIVATE_CI_REGISTRY]=$CI_REGISTRY --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_USER]=$CI_DEPLOY_USER --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_PASSWORD]=$CI_DEPLOY_PASSWORD </code>

== Example ==

You want to deploy the QDJ site with docker, and bind it to the server name <code>qdj.binets.fr</code>. Your site is running on flask and uses a postgresql database.

=== Pre-existant configuration ===

You have a little <code>Dockerfile</code>:

<pre># Base image: python3
FROM python:3
WORKDIR /usr/src/app

# Install dependacies
COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt

# Copy application files
COPY . .

EXPOSE 5000/tcp

# the command runs the migrations and then launches gunicorn to serve the app
CMD python -m flask db upgrade && gunicorn -b :5000 qdj:app</pre>
You have the following <code>docker-compose.yaml</code>:

<source lang="yaml">version: '3.1'

services:
db:
# Use a small postgres image, as we don't need anything on this container
image: postgres:alpine
environment:
POSTGRES_USER: qdj
POSTGRES_PASSWORD: somepassword
POSTGRES_DB: qdj
# store the data on a persistent file
volumes:
- "qdj-data:/var/lib/postgresql/data"
restart: always

app:
# Use the image from Dockerfile
image: ${DOCKER_IMAGE}
environment:
FLASK_APP: qdj.py
FLASK_ENV: production
FLASK_DEBUG: 0
DATABASE_URI: "postgresql://qdj:somepassword@db:5432/qdj"
SECRET_KEY:
# Tells to docker to start app after db (otherwise flask crashes)
depends_on:
- db
# Always restart on crash
restart: always

volumes:
qdj-data:</source>
=== Production <code>docker-compose.yaml</code> ===

We will adapt your <code>docker-compose.yaml</code> file in order to bind your site to the hostname :

<ol>
<li>First let's connect your <code>app</code> container to the global network. We won't bind the <code>db</code> container to the global network to protect it from intruders. [[File:https://cloud.binets.fr/s/QTgY55AapFDTyyW/preview|Network graph in endalcher]] We will add network configuration to the <code>docker-compose.yaml</code>:
<ul>
<li><p>to enable the network <code>web</code>, we add at the bottom of the file:</p>
<source lang="yaml">networks:
web:
external: true</source></li>
<li><p>to connect <code>app</code> to the network <code>web</code>, we add to the <code>app</code> configuration:</p>
<source lang="yaml">networks:
- web
- default</source></li></ul>
</li>
<li><p>Then we can add labels to tell <code>traefik</code> to match the hostname to a packet going to <code>app</code>:</p>
<source lang="yaml">labels:
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:qdj.binets.fr"
- "traefik.port=5000"</source></li></ol>

This gives us the following <code>docker-compose.qdj.yaml</code>:

<source lang="yaml">version: '3.1'

services:

db:
image: postgres:alpine
restart: always
environment:
POSTGRES_USER: qdj
POSTGRES_PASSWORD: qdjpw
POSTGRES_DB: qdj
volumes:
- "qdj-data:/var/lib/postgresql/data"

app:
image: ${DOCKER_IMAGE}
environment:
FLASK_APP: qdj.py
FLASK_ENV: production
FLASK_DEBUG: 0
DATABASE_URI: "postgresql://qdj:qdjpw@db:5432/qdj"
SECRET_KEY:
depends_on:
- db
restart: always
networks:
- web
- default
labels:
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:qdj.binets.fr"
- "traefik.port=5000"

volumes:
qdj-data:

networks:
web:
external: true</source>
This file goes into the [https://gitlab.binets.fr/br/docker-services br/docker-services] repository, it will be used by the triggered pipeline to create your containers.

=== Triggering pipelines with Gitlab CI ===

In this pipeline, we will need to add 2 jobs:

* one to build the docker image using the <code>Dockerfile</code>
* one to trigger the [https://gitlab.binets.fr/br/docker-services br/docker-services] pipeline to create the containers.

To build the docker image, we will use the template do so:

<source lang="yaml"># Build docker image and upload to registry
docker:build:
stage: build
only:
- master
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
# For disabling TLS in docker-in-docker (not needed)
DOCKER_TLS_CERTDIR: ''
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG</source>
The second job is rather tricky. We will use <code>curl</code> to trigger the pipeline, using [https://docs.gitlab.com/ce/ci/triggers/README.html Gitlab Pipeline API]. This call is secured by a trigger token, which should be saved into your project variables as <code>$TRIGGER_TOKEN</code>. This is what the job looks like:

<source lang="yaml">docker:deploy:
stage: deploy
when: manual
script:
- apt-get update && apt-get install -y curl
- curl --request POST --form token=$TRIGGER_TOKEN --form ref=master --form variables[PROJECT]=qdj --form variables[DOCKER_IMAGE]=$IMAGE_TAG https://gitlab.binets.fr/api/v4/projects/560/trigger/pipeline</source>
Pay attention to this syntax because debugging this api call takes a lot of time...

If you want to add variables that will be used in your <code>docker-compose.yaml</code>, add other arguments to <code>curl</code> like <code>--form variables[WELCOME_MESSAGE]="Hello World!"</code>.

You can see an example of a CI using this in the [https://gitlab.binets.fr/br/qdj br/qdj] repo.

Note: for BR project, you can use the <code>trigger</code> syntax in the API call since you don't need autorisation.

== History ==

* In 2017, the BR16 set up a [https://kubernetes.io/ Kubernetes] cluster. They managed to set up a workflow to deploy seamlessly from gitlab on that cluster. However, the configuration was hard to maintain and the BR17 was not able to keep it going.
* In 2018, the BR17 (Oliver Facklam + Hadrien Renaud) set up a small docker service on a computer from the Salle Informatiques

= Developping a site for BR docker deployement =

Docker allows for most technologies to be abstracted into a container and thus most - if not all - sites can be deployed in docker. However, here is a bit of advice to make deployement less painful :

* Before using a particular external service (something that should run in a seperate container), check that a well supported docker image exists and with a BRman that there are no other constraints (for example, using a MinIO will go through a seperate dedicated server that already exists rather than a container).
* Use a postgres database to get access to an admin website for your server.

Tuto pour le déploiement des sites avec Docker

2026-08-05T12:44:01Z

Daniela.cojocaru :

<languages/>
<translate>

A la fin de ce tuto, vous pourrez déployer votre site (ou service) sur les serveurs du BR ! Ceci permet de profiter d'une infrastructure gratuite, performante et robuste !


Note : ce tutoriel peut être délicat, n'hésitez pas à contacter un BRman pour obtenir de l'aide.
</translate>

<translate>
= Comment déployer des conteneurs Docker sur l'infrastructure du BR = 
</translate>

<translate>
== Overview == 


This tutorial will walk you through :
* How to convert your website to a Docker service
* How to build it automatically on Gitlab-CI
* How to deploy it automatically on our servers
</translate>

<translate>
== Requirements == 


* Basics of git (videos [https://git-scm.com/video/what-is-version-control here] or the beginning of [https://git-scm.com/book/en/v2 this awesome online book]) ;
* Basics of containers (see a really good explanation [https://www.docker.com/resources/what-container here]) and of docker-compose (see the getting-started [https://docs.docker.com/compose/gettingstarted/ here]) ;
* Basics of web (see an [https://developer.mozilla.org/en-US/docs/Learn/Getting_started_with_the_web/How_the_Web_works introduction] on MDN) ;
* Basics of gitlab-ci (reading the [https://docs.gitlab.com/ee/ci/ getting-started] is recommended) ;
</translate>

<translate>
== Existing architecture == 


A physical server called <code>endalcher</code> deploys and runs your container. It uses the following services to connect your service to the Internet:


* [https://docs.docker.com/compose/ docker-compose] to deploy the correct environment for your containers ;
* [https://docs.traefik.io/v1.7/ traefik] as a reverse proxy to serve your site behind your endpoint, it is configured [https://gitlab.binets.fr/br/docker-default-services here] ;
* nginx to serve your site to the outside world (as all the binets sites).
</translate>

<translate>
== How to convert your website to a Docker service == 


The exact procedure will be dependant on your project. An example can be found here : [https://gitlab.binets.fr/br/qdj/-/blob/master/deployment/Dockerfile?ref_type=heads qdj-Dockerfile]


A ''Docker container'' is an isolated machine on which you can run your website. In this step, we will help you convert you app to be Docker-ready. This basically means installing everything your app needs inside a linux computer. You'll need to install ''Docker'' on your computer first [https://docs.docker.com/desktop/install/windows-install/ windows-installer].


We assume your project is hosted on the [https://gitlab.binets.fr BR's gitlab instance]. Create a <code>deployment</code> directory at the root of your repository and create a file <code>Dockerfile</code> (with no extension) and a file <code>docker-compose.yaml</code> in it.
</translate>

* Dockerfile
<source lang="yaml">
FROM hello-world
</source>

* docker-compose.yaml
<source lang="yaml">
# this is a docker-compose meant for local testing of the deployment image.
# for the real deployment, go to the docker-services BR gitlab project

version: "3"
services:
app:
build:
context: ..
dockerfile: deployment/Dockerfile
# ports:
# - "8000:8000"
</source>

<translate>

Then open a terminal in this directory and type <code>docker compose up --build</code>. If everything went well, you see a nice message from Docker telling you everything is working !


Now, you need to make ''your'' app work in the docker container. For this, you need:


* To update the Dockerfile to install everything you need. The following works for a basic (Django) python app :
</translate>
<source>
FROM python:3

# copies all the code inside the container
COPY . /my_super_project

WORKDIR /my_super_project
RUN pip install --no-cache-dir -r requirements.txt
CMD python3 manage.py runserver
</source>

* To update the docker-compose file to expose the port you need (uncomment the corresponding line in the dockerfile).

=== How to handle persistant data ===

If you app uses an external database or need to not lose some files accross resets, you should use ''docker volumes'' with or without a ''postgres'' image. The [https://gitlab.binets.fr/br/docker-services/-/blob/master/docker-compose.site-jtx.yml?ref_type=heads jtx-docker-compose] might help you understand what you need.

=== How to handle secrets ===

Often your app has some secrets in a file (such as ''.env'') that is not in Git. DO NOT put it in git (or all your secrets will be stolen !). Later we are going to see how to securely make them available for the automatic gitlab build.

== Automatic build ==

We will you ''gitlab continuous integration'' to build your docker image directly on the BR's servers. Write the following into a file name <code>.gitlab-ci.yml</code> at the root of your repository :

<source lang="yaml"># Build docker image and upload to registry
variables:
IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_PIPELINE_IID
PROJECT: mySuperProject

docker:build:
stage: build
only: # put here the git branches you want the job to run on :
- main
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
DOCKER_TLS_CERTDIR: '' # disables TLS in docker-in-docker (not needed)
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG
</source>

As you commit this file to Gitlab, you should see a new job appear (or look under Build/jobs). Your image should build correctly (if not, it means something is not available to gitlab that is when you build on your computer. Read the job logs and try to fix it !)

=== Checking the image ===

This step is optional, but it is the easiest way to debug your image ! You can run it locally like so :

<source lang=bash>
docker login registry.binets.fr
docker run --rm registry.binets.fr/<nom.prenom>/<my-gitlab-repo>:<image>
</source>

Where <code>image</code> is the number of the image (available in <code>Gitlab -> Deploy -> Container registry</code>) and <code><nom.prenom>/<my-gitlab-repo></code> is the same as in your project Gitlab URL.

Typically, your app won't start because you forgot a secret file (see below how to manage that !).

== Automatic deployment ==

We will now add a second CI job to your repository to deploy your image. It will trigger ''another'' CI pipeline of [https://gitlab.binets.fr/br/docker-services br/docker-services]. This pipeline has the rights to deploy on <code>endalcher</code>, and does so using a <code>docker-compose.yaml</code> file. To trigger it, add the following to your <code>.gitlab-ci.yml</code>

<source lang=yaml>
docker:deploy:
stage: deploy
only:
- stable
image: debian:latest
when: manual
script:
- apt-get update && apt-get install -y curl
- curl --fail-with-body --request POST --form token=$TRIGGER_TOKEN --form ref=master --form variables[PROJECT]=$PROJECT --form variables[DOCKER_IMAGE]=$IMAGE_TAG https://gitlab.binets.fr/api/v4/projects/560/trigger/pipeline
</source>

Make sure the variable <code>PROJECT</code> in <code>.gitlab-ci.yml</code> is correct : our pipeline will deploy the file named <code>docker-compose.${PROJECT}.yaml</code>.

In order to create the correct <code>docker-compose.${PROJECT}.yaml</code> file, you will need to create a Merge Request on [https://gitlab.binets.fr/br/docker-services br/docker-services], or send a <code>docker-compose.yaml</code> file to a BRman. The [https://gitlab.binets.fr/br/docker-services br/docker-services] is full of examples and a basic one is explained below :

=== Extra parameters and secrets ===

''Be aware that any secret passed this way is still visible to the BR and everyone that has maintainer access to you repository ! If you need help setting up, don't hesitate to ask for help from the BR !''

You can also pass any parameter needed in the compose file by adding arguments to the cURL call like so : <code>--form variables[MY_SUPER_VARIABLE]="elle vaut 42!"</code>

If you want to pass secret environnements variables, store them in <code>Gitlab -> Settings -> CI-CD -> Variables</code> and make sure they are "protected" and "masked". Pass them like so <code>--form variables[MY_PASSWORD]=$PASSWORD_STORED_IN_GITLAB</code>.

=== Secret files ===

''Be aware that any secret passed this way too is visible to the BR and everyone that has ''ANY'' access to you repository (because they can get the docker image) ! So only do this for a private registry or make sure your setting <code>Settings -> General -> Visibility, project features, permissions</code> only allows for registry access for members''

Another way to store secrets in your Gitlab repo is <code>Gitlab -> Settings -> CI-CD -> Secure-files</code>. You can upload any (small) secret file here and it will not be exposed ! You can downlod it at buildtime like so :

<source lang=yaml>
# Build docker image and upload to registry
docker:build:
stage: build
only:
- main
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
# For disabling TLS in docker-in-docker (not needed)
DOCKER_TLS_CERTDIR: ""
# !!! where to download our secure .env file
SECURE_FILES_DOWNLOAD_PATH: "."
script:
# !!! download secure .env file
- apk add --no-cache curl bash
- curl --silent "https://gitlab.com/gitlab-org/incubation-engineering/mobile-devops/download-secure-files/-/raw/main/installer" | bash
# build docker image
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG
- echo "=> pushed $IMAGE_TAG"
</source>

=== Private repository ===

Keeping your repository private can be beneficial for security or privacy. But it require an extra step for the BR to access the docker image. We wille pass a [https://docs.gitlab.com/ee/user/project/deploy_tokens/#gitlab-deploy-token CI deploy token] as cURL parameter.

* Go to your <code>Settings -> Repository -> Deploy token</code> and create a token name exactly <code>gitlab-deploy-token</code>

* Add the following parameters to the cURL call in your CI deploy job : <code> --form variables[OPTIONAL_PRIVATE_CI_REGISTRY]=$CI_REGISTRY --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_USER]=$CI_DEPLOY_USER --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_PASSWORD]=$CI_DEPLOY_PASSWORD </code>

== Example ==

You want to deploy the QDJ site with docker, and bind it to the server name <code>qdj.binets.fr</code>. Your site is running on flask and uses a postgresql database.

=== Pre-existant configuration ===

You have a little <code>Dockerfile</code>:

<pre># Base image: python3
FROM python:3
WORKDIR /usr/src/app

# Install dependacies
COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt

# Copy application files
COPY . .

EXPOSE 5000/tcp

# the command runs the migrations and then launches gunicorn to serve the app
CMD python -m flask db upgrade && gunicorn -b :5000 qdj:app</pre>
You have the following <code>docker-compose.yaml</code>:

<source lang="yaml">version: '3.1'

services:
db:
# Use a small postgres image, as we don't need anything on this container
image: postgres:alpine
environment:
POSTGRES_USER: qdj
POSTGRES_PASSWORD: somepassword
POSTGRES_DB: qdj
# store the data on a persistent file
volumes:
- "qdj-data:/var/lib/postgresql/data"
restart: always

app:
# Use the image from Dockerfile
image: ${DOCKER_IMAGE}
environment:
FLASK_APP: qdj.py
FLASK_ENV: production
FLASK_DEBUG: 0
DATABASE_URI: "postgresql://qdj:somepassword@db:5432/qdj"
SECRET_KEY:
# Tells to docker to start app after db (otherwise flask crashes)
depends_on:
- db
# Always restart on crash
restart: always

volumes:
qdj-data:</source>
=== Production <code>docker-compose.yaml</code> ===

We will adapt your <code>docker-compose.yaml</code> file in order to bind your site to the hostname :

<ol>
<li>First let's connect your <code>app</code> container to the global network. We won't bind the <code>db</code> container to the global network to protect it from intruders. [[File:https://cloud.binets.fr/s/QTgY55AapFDTyyW/preview|Network graph in endalcher]] We will add network configuration to the <code>docker-compose.yaml</code>:
<ul>
<li><p>to enable the network <code>web</code>, we add at the bottom of the file:</p>
<source lang="yaml">networks:
web:
external: true</source></li>
<li><p>to connect <code>app</code> to the network <code>web</code>, we add to the <code>app</code> configuration:</p>
<source lang="yaml">networks:
- web
- default</source></li></ul>
</li>
<li><p>Then we can add labels to tell <code>traefik</code> to match the hostname to a packet going to <code>app</code>:</p>
<source lang="yaml">labels:
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:qdj.binets.fr"
- "traefik.port=5000"</source></li></ol>

This gives us the following <code>docker-compose.qdj.yaml</code>:

<source lang="yaml">version: '3.1'

services:

db:
image: postgres:alpine
restart: always
environment:
POSTGRES_USER: qdj
POSTGRES_PASSWORD: qdjpw
POSTGRES_DB: qdj
volumes:
- "qdj-data:/var/lib/postgresql/data"

app:
image: ${DOCKER_IMAGE}
environment:
FLASK_APP: qdj.py
FLASK_ENV: production
FLASK_DEBUG: 0
DATABASE_URI: "postgresql://qdj:qdjpw@db:5432/qdj"
SECRET_KEY:
depends_on:
- db
restart: always
networks:
- web
- default
labels:
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:qdj.binets.fr"
- "traefik.port=5000"

volumes:
qdj-data:

networks:
web:
external: true</source>
This file goes into the [https://gitlab.binets.fr/br/docker-services br/docker-services] repository, it will be used by the triggered pipeline to create your containers.

=== Triggering pipelines with Gitlab CI ===

In this pipeline, we will need to add 2 jobs:

* one to build the docker image using the <code>Dockerfile</code>
* one to trigger the [https://gitlab.binets.fr/br/docker-services br/docker-services] pipeline to create the containers.

To build the docker image, we will use the template do so:

<source lang="yaml"># Build docker image and upload to registry
docker:build:
stage: build
only:
- master
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
# For disabling TLS in docker-in-docker (not needed)
DOCKER_TLS_CERTDIR: ''
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG</source>
The second job is rather tricky. We will use <code>curl</code> to trigger the pipeline, using [https://docs.gitlab.com/ce/ci/triggers/README.html Gitlab Pipeline API]. This call is secured by a trigger token, which should be saved into your project variables as <code>$TRIGGER_TOKEN</code>. This is what the job looks like:

<source lang="yaml">docker:deploy:
stage: deploy
when: manual
script:
- apt-get update && apt-get install -y curl
- curl --request POST --form token=$TRIGGER_TOKEN --form ref=master --form variables[PROJECT]=qdj --form variables[DOCKER_IMAGE]=$IMAGE_TAG https://gitlab.binets.fr/api/v4/projects/560/trigger/pipeline</source>
Pay attention to this syntax because debugging this api call takes a lot of time...

If you want to add variables that will be used in your <code>docker-compose.yaml</code>, add other arguments to <code>curl</code> like <code>--form variables[WELCOME_MESSAGE]="Hello World!"</code>.

You can see an example of a CI using this in the [https://gitlab.binets.fr/br/qdj br/qdj] repo.

Note: for BR project, you can use the <code>trigger</code> syntax in the API call since you don't need autorisation.

== History ==

* In 2017, the BR16 set up a [https://kubernetes.io/ Kubernetes] cluster. They managed to set up a workflow to deploy seamlessly from gitlab on that cluster. However, the configuration was hard to maintain and the BR17 was not able to keep it going.
* In 2018, the BR17 (Oliver Facklam + Hadrien Renaud) set up a small docker service on a computer from the Salle Informatiques

= Developping a site for BR docker deployement =

Docker allows for most technologies to be abstracted into a container and thus most - if not all - sites can be deployed in docker. However, here is a bit of advice to make deployement less painful :

* Before using a particular external service (something that should run in a seperate container), check that a well supported docker image exists and with a BRman that there are no other constraints (for example, using a MinIO will go through a seperate dedicated server that already exists rather than a container).
* Use a postgres database to get access to an admin website for your server.

Translations:Tuto pour le déploiement des sites avec Docker/17/en

2026-08-05T12:41:11Z

Daniela.cojocaru : Page créée avec « * To update the Dockerfile to install everything you need. The following works for a basic (Django) python app : »

* To update the Dockerfile to install everything you need. The following works for a basic (Django) python app :

Translations:Tuto pour le déploiement des sites avec Docker/16/en

2026-08-05T12:41:04Z

Daniela.cojocaru : Page créée avec « Now, you need to make ''your'' app work in the docker container. For this, you need: »

Now, you need to make ''your'' app work in the docker container. For this, you need:

Translations:Tuto pour le déploiement des sites avec Docker/15/en

2026-08-05T12:40:59Z

Daniela.cojocaru : Page créée avec « Then open a terminal in this directory and type <code>docker compose up --build</code>. If everything went well, you see a nice message from Docker telling you everything is working! »

Then open a terminal in this directory and type <code>docker compose up --build</code>. If everything went well, you see a nice message from Docker telling you everything is working!

Tuto pour le déploiement des sites avec Docker/en

2026-08-05T12:40:56Z

Daniela.cojocaru : Page créée avec « We assume your project is hosted on the [https://gitlab.binets.fr BR's gitlab instance]. Create a <code>deployment</code> directory at the root of your repository and create a file <code>Dockerfile</code> (with no extension) and a file <code>docker-compose.yaml</code> in it. »

At the end of this tutorial you will be able to deploy your website (or service) on the servers of the BR! This allows you to benefit from a free, high-performance and robust infrastructure!

Note: this tutorial may be a bit tricky, so please don’t hesitate to get in touch with a BRman to get help.

<span id="Comment_déployer_des_conteneurs_Docker_sur_l'infrastructure_du_BR"></span>
= How to deploy Docker containers on the infrastructure of the BR =

== Overview ==

This tutorial will walk you through :
* How to convert your website to a Docker service
* How to build it automatically on Gitlab-CI
* How to deploy it automatically on our servers

== Requirements ==

* Basics of git (videos [https://git-scm.com/video/what-is-version-control here] or the beginning of [https://git-scm.com/book/en/v2 this awesome online book]) ;
* Basics of containers (see a really good explanation [https://www.docker.com/resources/what-container here]) and of docker-compose (see the getting-started [https://docs.docker.com/compose/gettingstarted/ here]) ;
* Basics of web (see an [https://developer.mozilla.org/en-US/docs/Learn/Getting_started_with_the_web/How_the_Web_works introduction] on MDN) ;
* Basics of gitlab-ci (reading the [https://docs.gitlab.com/ee/ci/ getting-started] is recommended) ;

== Existing architecture ==

A physical server called <code>endalcher</code> deploys and runs your container. It uses the following services to connect your service to the Interne:

* [https://docs.docker.com/compose/ docker-compose] to deploy the correct environment for your containers ;
* [https://docs.traefik.io/v1.7/ traefik] as a reverse proxy to serve your site behind your endpoint, it is configured [https://gitlab.binets.fr/br/docker-default-services here] ;
* nginx to serve your site to the outside world (as all the binets sites).

== How to convert your website to a Docker service ==

The exact procedure will be dependant on your project. An example can be found here : [https://gitlab.binets.fr/br/qdj/-/blob/master/deployment/Dockerfile?ref_type=heads qdj-Dockerfile]

A ''Docker container'' is an isolated machine on which you can run your website. In this step, we will help you convert you app to be Docker-ready. This basically means installing everything your app needs inside a linux computer. You'll need to install ''Docker'' on your computer first [https://docs.docker.com/desktop/install/windows-install/ windows-installer].

We assume your project is hosted on the [https://gitlab.binets.fr BR's gitlab instance]. Create a <code>deployment</code> directory at the root of your repository and create a file <code>Dockerfile</code> (with no extension) and a file <code>docker-compose.yaml</code> in it.

* Dockerfile
<source lang="yaml">
FROM hello-world
</source>

* docker-compose.yaml
<source lang="yaml">
# this is a docker-compose meant for local testing of the deployment image.
# for the real deployment, go to the docker-services BR gitlab project

version: "3"
services:
app:
build:
context: ..
dockerfile: deployment/Dockerfile
# ports:
# - "8000:8000"
</source>

<div lang="fr" dir="ltr" class="mw-content-ltr">
Then open a terminal in this directory and type <code>docker compose up --build</code>. If everything went well, you see a nice message from Docker telling you everything is working !
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
Now, you need to make ''your'' app work in the docker container. For this, you need:
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
* To update the Dockerfile to install everything you need. The following works for a basic (Django) python app :
</div>
<source>
FROM python:3

# copies all the code inside the container
COPY . /my_super_project

WORKDIR /my_super_project
RUN pip install --no-cache-dir -r requirements.txt
CMD python3 manage.py runserver
</source>

* To update the docker-compose file to expose the port you need (uncomment the corresponding line in the dockerfile).

=== How to handle persistant data ===

If you app uses an external database or need to not lose some files accross resets, you should use ''docker volumes'' with or without a ''postgres'' image. The [https://gitlab.binets.fr/br/docker-services/-/blob/master/docker-compose.site-jtx.yml?ref_type=heads jtx-docker-compose] might help you understand what you need.

=== How to handle secrets ===

Often your app has some secrets in a file (such as ''.env'') that is not in Git. DO NOT put it in git (or all your secrets will be stolen !). Later we are going to see how to securely make them available for the automatic gitlab build.

== Automatic build ==

We will you ''gitlab continuous integration'' to build your docker image directly on the BR's servers. Write the following into a file name <code>.gitlab-ci.yml</code> at the root of your repository :

<source lang="yaml"># Build docker image and upload to registry
variables:
IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_PIPELINE_IID
PROJECT: mySuperProject

docker:build:
stage: build
only: # put here the git branches you want the job to run on :
- main
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
DOCKER_TLS_CERTDIR: '' # disables TLS in docker-in-docker (not needed)
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG
</source>

As you commit this file to Gitlab, you should see a new job appear (or look under Build/jobs). Your image should build correctly (if not, it means something is not available to gitlab that is when you build on your computer. Read the job logs and try to fix it !)

=== Checking the image ===

This step is optional, but it is the easiest way to debug your image ! You can run it locally like so :

<source lang=bash>
docker login registry.binets.fr
docker run --rm registry.binets.fr/<nom.prenom>/<my-gitlab-repo>:<image>
</source>

Where <code>image</code> is the number of the image (available in <code>Gitlab -> Deploy -> Container registry</code>) and <code><nom.prenom>/<my-gitlab-repo></code> is the same as in your project Gitlab URL.

Typically, your app won't start because you forgot a secret file (see below how to manage that !).

== Automatic deployment ==

We will now add a second CI job to your repository to deploy your image. It will trigger ''another'' CI pipeline of [https://gitlab.binets.fr/br/docker-services br/docker-services]. This pipeline has the rights to deploy on <code>endalcher</code>, and does so using a <code>docker-compose.yaml</code> file. To trigger it, add the following to your <code>.gitlab-ci.yml</code>

<source lang=yaml>
docker:deploy:
stage: deploy
only:
- stable
image: debian:latest
when: manual
script:
- apt-get update && apt-get install -y curl
- curl --fail-with-body --request POST --form token=$TRIGGER_TOKEN --form ref=master --form variables[PROJECT]=$PROJECT --form variables[DOCKER_IMAGE]=$IMAGE_TAG https://gitlab.binets.fr/api/v4/projects/560/trigger/pipeline
</source>

Make sure the variable <code>PROJECT</code> in <code>.gitlab-ci.yml</code> is correct : our pipeline will deploy the file named <code>docker-compose.${PROJECT}.yaml</code>.

In order to create the correct <code>docker-compose.${PROJECT}.yaml</code> file, you will need to create a Merge Request on [https://gitlab.binets.fr/br/docker-services br/docker-services], or send a <code>docker-compose.yaml</code> file to a BRman. The [https://gitlab.binets.fr/br/docker-services br/docker-services] is full of examples and a basic one is explained below :

=== Extra parameters and secrets ===

''Be aware that any secret passed this way is still visible to the BR and everyone that has maintainer access to you repository ! If you need help setting up, don't hesitate to ask for help from the BR !''

You can also pass any parameter needed in the compose file by adding arguments to the cURL call like so : <code>--form variables[MY_SUPER_VARIABLE]="elle vaut 42!"</code>

If you want to pass secret environnements variables, store them in <code>Gitlab -> Settings -> CI-CD -> Variables</code> and make sure they are "protected" and "masked". Pass them like so <code>--form variables[MY_PASSWORD]=$PASSWORD_STORED_IN_GITLAB</code>.

=== Secret files ===

''Be aware that any secret passed this way too is visible to the BR and everyone that has ''ANY'' access to you repository (because they can get the docker image) ! So only do this for a private registry or make sure your setting <code>Settings -> General -> Visibility, project features, permissions</code> only allows for registry access for members''

Another way to store secrets in your Gitlab repo is <code>Gitlab -> Settings -> CI-CD -> Secure-files</code>. You can upload any (small) secret file here and it will not be exposed ! You can downlod it at buildtime like so :

<source lang=yaml>
# Build docker image and upload to registry
docker:build:
stage: build
only:
- main
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
# For disabling TLS in docker-in-docker (not needed)
DOCKER_TLS_CERTDIR: ""
# !!! where to download our secure .env file
SECURE_FILES_DOWNLOAD_PATH: "."
script:
# !!! download secure .env file
- apk add --no-cache curl bash
- curl --silent "https://gitlab.com/gitlab-org/incubation-engineering/mobile-devops/download-secure-files/-/raw/main/installer" | bash
# build docker image
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG
- echo "=> pushed $IMAGE_TAG"
</source>

=== Private repository ===

Keeping your repository private can be beneficial for security or privacy. But it require an extra step for the BR to access the docker image. We wille pass a [https://docs.gitlab.com/ee/user/project/deploy_tokens/#gitlab-deploy-token CI deploy token] as cURL parameter.

* Go to your <code>Settings -> Repository -> Deploy token</code> and create a token name exactly <code>gitlab-deploy-token</code>

* Add the following parameters to the cURL call in your CI deploy job : <code> --form variables[OPTIONAL_PRIVATE_CI_REGISTRY]=$CI_REGISTRY --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_USER]=$CI_DEPLOY_USER --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_PASSWORD]=$CI_DEPLOY_PASSWORD </code>

== Example ==

You want to deploy the QDJ site with docker, and bind it to the server name <code>qdj.binets.fr</code>. Your site is running on flask and uses a postgresql database.

=== Pre-existant configuration ===

You have a little <code>Dockerfile</code>:

<pre># Base image: python3
FROM python:3
WORKDIR /usr/src/app

# Install dependacies
COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt

# Copy application files
COPY . .

EXPOSE 5000/tcp

# the command runs the migrations and then launches gunicorn to serve the app
CMD python -m flask db upgrade && gunicorn -b :5000 qdj:app</pre>
You have the following <code>docker-compose.yaml</code>:

<source lang="yaml">version: '3.1'

services:
db:
# Use a small postgres image, as we don't need anything on this container
image: postgres:alpine
environment:
POSTGRES_USER: qdj
POSTGRES_PASSWORD: somepassword
POSTGRES_DB: qdj
# store the data on a persistent file
volumes:
- "qdj-data:/var/lib/postgresql/data"
restart: always

app:
# Use the image from Dockerfile
image: ${DOCKER_IMAGE}
environment:
FLASK_APP: qdj.py
FLASK_ENV: production
FLASK_DEBUG: 0
DATABASE_URI: "postgresql://qdj:somepassword@db:5432/qdj"
SECRET_KEY:
# Tells to docker to start app after db (otherwise flask crashes)
depends_on:
- db
# Always restart on crash
restart: always

volumes:
qdj-data:</source>
=== Production <code>docker-compose.yaml</code> ===

We will adapt your <code>docker-compose.yaml</code> file in order to bind your site to the hostname :

<ol>
<li>First let's connect your <code>app</code> container to the global network. We won't bind the <code>db</code> container to the global network to protect it from intruders. [[File:https://cloud.binets.fr/s/QTgY55AapFDTyyW/preview|Network graph in endalcher]] We will add network configuration to the <code>docker-compose.yaml</code>:
<ul>
<li><p>to enable the network <code>web</code>, we add at the bottom of the file:</p>
<source lang="yaml">networks:
web:
external: true</source></li>
<li><p>to connect <code>app</code> to the network <code>web</code>, we add to the <code>app</code> configuration:</p>
<source lang="yaml">networks:
- web
- default</source></li></ul>
</li>
<li><p>Then we can add labels to tell <code>traefik</code> to match the hostname to a packet going to <code>app</code>:</p>
<source lang="yaml">labels:
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:qdj.binets.fr"
- "traefik.port=5000"</source></li></ol>

This gives us the following <code>docker-compose.qdj.yaml</code>:

<source lang="yaml">version: '3.1'

services:

db:
image: postgres:alpine
restart: always
environment:
POSTGRES_USER: qdj
POSTGRES_PASSWORD: qdjpw
POSTGRES_DB: qdj
volumes:
- "qdj-data:/var/lib/postgresql/data"

app:
image: ${DOCKER_IMAGE}
environment:
FLASK_APP: qdj.py
FLASK_ENV: production
FLASK_DEBUG: 0
DATABASE_URI: "postgresql://qdj:qdjpw@db:5432/qdj"
SECRET_KEY:
depends_on:
- db
restart: always
networks:
- web
- default
labels:
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:qdj.binets.fr"
- "traefik.port=5000"

volumes:
qdj-data:

networks:
web:
external: true</source>
This file goes into the [https://gitlab.binets.fr/br/docker-services br/docker-services] repository, it will be used by the triggered pipeline to create your containers.

=== Triggering pipelines with Gitlab CI ===

In this pipeline, we will need to add 2 jobs:

* one to build the docker image using the <code>Dockerfile</code>
* one to trigger the [https://gitlab.binets.fr/br/docker-services br/docker-services] pipeline to create the containers.

To build the docker image, we will use the template do so:

<source lang="yaml"># Build docker image and upload to registry
docker:build:
stage: build
only:
- master
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
# For disabling TLS in docker-in-docker (not needed)
DOCKER_TLS_CERTDIR: ''
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG</source>
The second job is rather tricky. We will use <code>curl</code> to trigger the pipeline, using [https://docs.gitlab.com/ce/ci/triggers/README.html Gitlab Pipeline API]. This call is secured by a trigger token, which should be saved into your project variables as <code>$TRIGGER_TOKEN</code>. This is what the job looks like:

<source lang="yaml">docker:deploy:
stage: deploy
when: manual
script:
- apt-get update && apt-get install -y curl
- curl --request POST --form token=$TRIGGER_TOKEN --form ref=master --form variables[PROJECT]=qdj --form variables[DOCKER_IMAGE]=$IMAGE_TAG https://gitlab.binets.fr/api/v4/projects/560/trigger/pipeline</source>
Pay attention to this syntax because debugging this api call takes a lot of time...

If you want to add variables that will be used in your <code>docker-compose.yaml</code>, add other arguments to <code>curl</code> like <code>--form variables[WELCOME_MESSAGE]="Hello World!"</code>.

You can see an example of a CI using this in the [https://gitlab.binets.fr/br/qdj br/qdj] repo.

Note: for BR project, you can use the <code>trigger</code> syntax in the API call since you don't need autorisation.

== History ==

* In 2017, the BR16 set up a [https://kubernetes.io/ Kubernetes] cluster. They managed to set up a workflow to deploy seamlessly from gitlab on that cluster. However, the configuration was hard to maintain and the BR17 was not able to keep it going.
* In 2018, the BR17 (Oliver Facklam + Hadrien Renaud) set up a small docker service on a computer from the Salle Informatiques

= Developping a site for BR docker deployement =

Docker allows for most technologies to be abstracted into a container and thus most - if not all - sites can be deployed in docker. However, here is a bit of advice to make deployement less painful :

* Before using a particular external service (something that should run in a seperate container), check that a well supported docker image exists and with a BRman that there are no other constraints (for example, using a MinIO will go through a seperate dedicated server that already exists rather than a container).
* Use a postgres database to get access to an admin website for your server.

Translations:Tuto pour le déploiement des sites avec Docker/14/en

2026-08-05T12:40:53Z

We assume your project is hosted on the [https://gitlab.binets.fr BR's gitlab instance]. Create a <code>deployment</code> directory at the root of your repository and create a file <code>Dockerfile</code> (with no extension) and a file <code>docker-compose.yaml</code> in it.

Tuto pour le déploiement des sites avec Docker/en

2026-08-05T12:40:52Z

Daniela.cojocaru : Page créée avec « A ''Docker container'' is an isolated machine on which you can run your website. In this step, we will help you convert you app to be Docker-ready. This basically means installing everything your app needs inside a linux computer. You'll need to install ''Docker'' on your computer first [https://docs.docker.com/desktop/install/windows-install/ windows-installer]. »

At the end of this tutorial you will be able to deploy your website (or service) on the servers of the BR! This allows you to benefit from a free, high-performance and robust infrastructure!

Note: this tutorial may be a bit tricky, so please don’t hesitate to get in touch with a BRman to get help.

<span id="Comment_déployer_des_conteneurs_Docker_sur_l'infrastructure_du_BR"></span>
= How to deploy Docker containers on the infrastructure of the BR =

== Overview ==

This tutorial will walk you through :
* How to convert your website to a Docker service
* How to build it automatically on Gitlab-CI
* How to deploy it automatically on our servers

== Requirements ==

* Basics of git (videos [https://git-scm.com/video/what-is-version-control here] or the beginning of [https://git-scm.com/book/en/v2 this awesome online book]) ;
* Basics of containers (see a really good explanation [https://www.docker.com/resources/what-container here]) and of docker-compose (see the getting-started [https://docs.docker.com/compose/gettingstarted/ here]) ;
* Basics of web (see an [https://developer.mozilla.org/en-US/docs/Learn/Getting_started_with_the_web/How_the_Web_works introduction] on MDN) ;
* Basics of gitlab-ci (reading the [https://docs.gitlab.com/ee/ci/ getting-started] is recommended) ;

== Existing architecture ==

A physical server called <code>endalcher</code> deploys and runs your container. It uses the following services to connect your service to the Interne:

* [https://docs.docker.com/compose/ docker-compose] to deploy the correct environment for your containers ;
* [https://docs.traefik.io/v1.7/ traefik] as a reverse proxy to serve your site behind your endpoint, it is configured [https://gitlab.binets.fr/br/docker-default-services here] ;
* nginx to serve your site to the outside world (as all the binets sites).

== How to convert your website to a Docker service ==

The exact procedure will be dependant on your project. An example can be found here : [https://gitlab.binets.fr/br/qdj/-/blob/master/deployment/Dockerfile?ref_type=heads qdj-Dockerfile]

A ''Docker container'' is an isolated machine on which you can run your website. In this step, we will help you convert you app to be Docker-ready. This basically means installing everything your app needs inside a linux computer. You'll need to install ''Docker'' on your computer first [https://docs.docker.com/desktop/install/windows-install/ windows-installer].

<div lang="fr" dir="ltr" class="mw-content-ltr">
We assume your project is hosted on the [https://gitlab.binets.fr BR's gitlab instance]. Create a <code>deployment</code> directory at the root of your repository and create a file <code>Dockerfile</code> (with no extension) and a file <code>docker-compose.yaml</code> in it.
</div>

* Dockerfile
<source lang="yaml">
FROM hello-world
</source>

* docker-compose.yaml
<source lang="yaml">
# this is a docker-compose meant for local testing of the deployment image.
# for the real deployment, go to the docker-services BR gitlab project

version: "3"
services:
app:
build:
context: ..
dockerfile: deployment/Dockerfile
# ports:
# - "8000:8000"
</source>

<div lang="fr" dir="ltr" class="mw-content-ltr">
Then open a terminal in this directory and type <code>docker compose up --build</code>. If everything went well, you see a nice message from Docker telling you everything is working !
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
Now, you need to make ''your'' app work in the docker container. For this, you need:
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
* To update the Dockerfile to install everything you need. The following works for a basic (Django) python app :
</div>
<source>
FROM python:3

# copies all the code inside the container
COPY . /my_super_project

WORKDIR /my_super_project
RUN pip install --no-cache-dir -r requirements.txt
CMD python3 manage.py runserver
</source>

* To update the docker-compose file to expose the port you need (uncomment the corresponding line in the dockerfile).

=== How to handle persistant data ===

If you app uses an external database or need to not lose some files accross resets, you should use ''docker volumes'' with or without a ''postgres'' image. The [https://gitlab.binets.fr/br/docker-services/-/blob/master/docker-compose.site-jtx.yml?ref_type=heads jtx-docker-compose] might help you understand what you need.

=== How to handle secrets ===

Often your app has some secrets in a file (such as ''.env'') that is not in Git. DO NOT put it in git (or all your secrets will be stolen !). Later we are going to see how to securely make them available for the automatic gitlab build.

== Automatic build ==

We will you ''gitlab continuous integration'' to build your docker image directly on the BR's servers. Write the following into a file name <code>.gitlab-ci.yml</code> at the root of your repository :

<source lang="yaml"># Build docker image and upload to registry
variables:
IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_PIPELINE_IID
PROJECT: mySuperProject

docker:build:
stage: build
only: # put here the git branches you want the job to run on :
- main
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
DOCKER_TLS_CERTDIR: '' # disables TLS in docker-in-docker (not needed)
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG
</source>

As you commit this file to Gitlab, you should see a new job appear (or look under Build/jobs). Your image should build correctly (if not, it means something is not available to gitlab that is when you build on your computer. Read the job logs and try to fix it !)

=== Checking the image ===

This step is optional, but it is the easiest way to debug your image ! You can run it locally like so :

<source lang=bash>
docker login registry.binets.fr
docker run --rm registry.binets.fr/<nom.prenom>/<my-gitlab-repo>:<image>
</source>

Where <code>image</code> is the number of the image (available in <code>Gitlab -> Deploy -> Container registry</code>) and <code><nom.prenom>/<my-gitlab-repo></code> is the same as in your project Gitlab URL.

Typically, your app won't start because you forgot a secret file (see below how to manage that !).

== Automatic deployment ==

We will now add a second CI job to your repository to deploy your image. It will trigger ''another'' CI pipeline of [https://gitlab.binets.fr/br/docker-services br/docker-services]. This pipeline has the rights to deploy on <code>endalcher</code>, and does so using a <code>docker-compose.yaml</code> file. To trigger it, add the following to your <code>.gitlab-ci.yml</code>

<source lang=yaml>
docker:deploy:
stage: deploy
only:
- stable
image: debian:latest
when: manual
script:
- apt-get update && apt-get install -y curl
- curl --fail-with-body --request POST --form token=$TRIGGER_TOKEN --form ref=master --form variables[PROJECT]=$PROJECT --form variables[DOCKER_IMAGE]=$IMAGE_TAG https://gitlab.binets.fr/api/v4/projects/560/trigger/pipeline
</source>

Make sure the variable <code>PROJECT</code> in <code>.gitlab-ci.yml</code> is correct : our pipeline will deploy the file named <code>docker-compose.${PROJECT}.yaml</code>.

In order to create the correct <code>docker-compose.${PROJECT}.yaml</code> file, you will need to create a Merge Request on [https://gitlab.binets.fr/br/docker-services br/docker-services], or send a <code>docker-compose.yaml</code> file to a BRman. The [https://gitlab.binets.fr/br/docker-services br/docker-services] is full of examples and a basic one is explained below :

=== Extra parameters and secrets ===

''Be aware that any secret passed this way is still visible to the BR and everyone that has maintainer access to you repository ! If you need help setting up, don't hesitate to ask for help from the BR !''

You can also pass any parameter needed in the compose file by adding arguments to the cURL call like so : <code>--form variables[MY_SUPER_VARIABLE]="elle vaut 42!"</code>

If you want to pass secret environnements variables, store them in <code>Gitlab -> Settings -> CI-CD -> Variables</code> and make sure they are "protected" and "masked". Pass them like so <code>--form variables[MY_PASSWORD]=$PASSWORD_STORED_IN_GITLAB</code>.

=== Secret files ===

''Be aware that any secret passed this way too is visible to the BR and everyone that has ''ANY'' access to you repository (because they can get the docker image) ! So only do this for a private registry or make sure your setting <code>Settings -> General -> Visibility, project features, permissions</code> only allows for registry access for members''

Another way to store secrets in your Gitlab repo is <code>Gitlab -> Settings -> CI-CD -> Secure-files</code>. You can upload any (small) secret file here and it will not be exposed ! You can downlod it at buildtime like so :

<source lang=yaml>
# Build docker image and upload to registry
docker:build:
stage: build
only:
- main
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
# For disabling TLS in docker-in-docker (not needed)
DOCKER_TLS_CERTDIR: ""
# !!! where to download our secure .env file
SECURE_FILES_DOWNLOAD_PATH: "."
script:
# !!! download secure .env file
- apk add --no-cache curl bash
- curl --silent "https://gitlab.com/gitlab-org/incubation-engineering/mobile-devops/download-secure-files/-/raw/main/installer" | bash
# build docker image
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG
- echo "=> pushed $IMAGE_TAG"
</source>

=== Private repository ===

Keeping your repository private can be beneficial for security or privacy. But it require an extra step for the BR to access the docker image. We wille pass a [https://docs.gitlab.com/ee/user/project/deploy_tokens/#gitlab-deploy-token CI deploy token] as cURL parameter.

* Go to your <code>Settings -> Repository -> Deploy token</code> and create a token name exactly <code>gitlab-deploy-token</code>

* Add the following parameters to the cURL call in your CI deploy job : <code> --form variables[OPTIONAL_PRIVATE_CI_REGISTRY]=$CI_REGISTRY --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_USER]=$CI_DEPLOY_USER --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_PASSWORD]=$CI_DEPLOY_PASSWORD </code>

== Example ==

You want to deploy the QDJ site with docker, and bind it to the server name <code>qdj.binets.fr</code>. Your site is running on flask and uses a postgresql database.

=== Pre-existant configuration ===

You have a little <code>Dockerfile</code>:

<pre># Base image: python3
FROM python:3
WORKDIR /usr/src/app

# Install dependacies
COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt

# Copy application files
COPY . .

EXPOSE 5000/tcp

# the command runs the migrations and then launches gunicorn to serve the app
CMD python -m flask db upgrade && gunicorn -b :5000 qdj:app</pre>
You have the following <code>docker-compose.yaml</code>:

<source lang="yaml">version: '3.1'

services:
db:
# Use a small postgres image, as we don't need anything on this container
image: postgres:alpine
environment:
POSTGRES_USER: qdj
POSTGRES_PASSWORD: somepassword
POSTGRES_DB: qdj
# store the data on a persistent file
volumes:
- "qdj-data:/var/lib/postgresql/data"
restart: always

app:
# Use the image from Dockerfile
image: ${DOCKER_IMAGE}
environment:
FLASK_APP: qdj.py
FLASK_ENV: production
FLASK_DEBUG: 0
DATABASE_URI: "postgresql://qdj:somepassword@db:5432/qdj"
SECRET_KEY:
# Tells to docker to start app after db (otherwise flask crashes)
depends_on:
- db
# Always restart on crash
restart: always

volumes:
qdj-data:</source>
=== Production <code>docker-compose.yaml</code> ===

We will adapt your <code>docker-compose.yaml</code> file in order to bind your site to the hostname :

<ol>
<li>First let's connect your <code>app</code> container to the global network. We won't bind the <code>db</code> container to the global network to protect it from intruders. [[File:https://cloud.binets.fr/s/QTgY55AapFDTyyW/preview|Network graph in endalcher]] We will add network configuration to the <code>docker-compose.yaml</code>:
<ul>
<li><p>to enable the network <code>web</code>, we add at the bottom of the file:</p>
<source lang="yaml">networks:
web:
external: true</source></li>
<li><p>to connect <code>app</code> to the network <code>web</code>, we add to the <code>app</code> configuration:</p>
<source lang="yaml">networks:
- web
- default</source></li></ul>
</li>
<li><p>Then we can add labels to tell <code>traefik</code> to match the hostname to a packet going to <code>app</code>:</p>
<source lang="yaml">labels:
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:qdj.binets.fr"
- "traefik.port=5000"</source></li></ol>

This gives us the following <code>docker-compose.qdj.yaml</code>:

<source lang="yaml">version: '3.1'

services:

db:
image: postgres:alpine
restart: always
environment:
POSTGRES_USER: qdj
POSTGRES_PASSWORD: qdjpw
POSTGRES_DB: qdj
volumes:
- "qdj-data:/var/lib/postgresql/data"

app:
image: ${DOCKER_IMAGE}
environment:
FLASK_APP: qdj.py
FLASK_ENV: production
FLASK_DEBUG: 0
DATABASE_URI: "postgresql://qdj:qdjpw@db:5432/qdj"
SECRET_KEY:
depends_on:
- db
restart: always
networks:
- web
- default
labels:
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:qdj.binets.fr"
- "traefik.port=5000"

volumes:
qdj-data:

networks:
web:
external: true</source>
This file goes into the [https://gitlab.binets.fr/br/docker-services br/docker-services] repository, it will be used by the triggered pipeline to create your containers.

=== Triggering pipelines with Gitlab CI ===

In this pipeline, we will need to add 2 jobs:

* one to build the docker image using the <code>Dockerfile</code>
* one to trigger the [https://gitlab.binets.fr/br/docker-services br/docker-services] pipeline to create the containers.

To build the docker image, we will use the template do so:

<source lang="yaml"># Build docker image and upload to registry
docker:build:
stage: build
only:
- master
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
# For disabling TLS in docker-in-docker (not needed)
DOCKER_TLS_CERTDIR: ''
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG</source>
The second job is rather tricky. We will use <code>curl</code> to trigger the pipeline, using [https://docs.gitlab.com/ce/ci/triggers/README.html Gitlab Pipeline API]. This call is secured by a trigger token, which should be saved into your project variables as <code>$TRIGGER_TOKEN</code>. This is what the job looks like:

<source lang="yaml">docker:deploy:
stage: deploy
when: manual
script:
- apt-get update && apt-get install -y curl
- curl --request POST --form token=$TRIGGER_TOKEN --form ref=master --form variables[PROJECT]=qdj --form variables[DOCKER_IMAGE]=$IMAGE_TAG https://gitlab.binets.fr/api/v4/projects/560/trigger/pipeline</source>
Pay attention to this syntax because debugging this api call takes a lot of time...

If you want to add variables that will be used in your <code>docker-compose.yaml</code>, add other arguments to <code>curl</code> like <code>--form variables[WELCOME_MESSAGE]="Hello World!"</code>.

You can see an example of a CI using this in the [https://gitlab.binets.fr/br/qdj br/qdj] repo.

Note: for BR project, you can use the <code>trigger</code> syntax in the API call since you don't need autorisation.

== History ==

* In 2017, the BR16 set up a [https://kubernetes.io/ Kubernetes] cluster. They managed to set up a workflow to deploy seamlessly from gitlab on that cluster. However, the configuration was hard to maintain and the BR17 was not able to keep it going.
* In 2018, the BR17 (Oliver Facklam + Hadrien Renaud) set up a small docker service on a computer from the Salle Informatiques

= Developping a site for BR docker deployement =

Docker allows for most technologies to be abstracted into a container and thus most - if not all - sites can be deployed in docker. However, here is a bit of advice to make deployement less painful :

* Before using a particular external service (something that should run in a seperate container), check that a well supported docker image exists and with a BRman that there are no other constraints (for example, using a MinIO will go through a seperate dedicated server that already exists rather than a container).
* Use a postgres database to get access to an admin website for your server.

Translations:Tuto pour le déploiement des sites avec Docker/13/en

2026-08-05T12:40:48Z

A ''Docker container'' is an isolated machine on which you can run your website. In this step, we will help you convert you app to be Docker-ready. This basically means installing everything your app needs inside a linux computer. You'll need to install ''Docker'' on your computer first [https://docs.docker.com/desktop/install/windows-install/ windows-installer].

Tuto pour le déploiement des sites avec Docker/en

2026-08-05T12:40:45Z

Daniela.cojocaru : Page créée avec « The exact procedure will be dependant on your project. An example can be found here : [https://gitlab.binets.fr/br/qdj/-/blob/master/deployment/Dockerfile?ref_type=heads qdj-Dockerfile] »

At the end of this tutorial you will be able to deploy your website (or service) on the servers of the BR! This allows you to benefit from a free, high-performance and robust infrastructure!

Note: this tutorial may be a bit tricky, so please don’t hesitate to get in touch with a BRman to get help.

<span id="Comment_déployer_des_conteneurs_Docker_sur_l'infrastructure_du_BR"></span>
= How to deploy Docker containers on the infrastructure of the BR =

== Overview ==

This tutorial will walk you through :
* How to convert your website to a Docker service
* How to build it automatically on Gitlab-CI
* How to deploy it automatically on our servers

== Requirements ==

* Basics of git (videos [https://git-scm.com/video/what-is-version-control here] or the beginning of [https://git-scm.com/book/en/v2 this awesome online book]) ;
* Basics of containers (see a really good explanation [https://www.docker.com/resources/what-container here]) and of docker-compose (see the getting-started [https://docs.docker.com/compose/gettingstarted/ here]) ;
* Basics of web (see an [https://developer.mozilla.org/en-US/docs/Learn/Getting_started_with_the_web/How_the_Web_works introduction] on MDN) ;
* Basics of gitlab-ci (reading the [https://docs.gitlab.com/ee/ci/ getting-started] is recommended) ;

== Existing architecture ==

A physical server called <code>endalcher</code> deploys and runs your container. It uses the following services to connect your service to the Interne:

* [https://docs.docker.com/compose/ docker-compose] to deploy the correct environment for your containers ;
* [https://docs.traefik.io/v1.7/ traefik] as a reverse proxy to serve your site behind your endpoint, it is configured [https://gitlab.binets.fr/br/docker-default-services here] ;
* nginx to serve your site to the outside world (as all the binets sites).

== How to convert your website to a Docker service ==

The exact procedure will be dependant on your project. An example can be found here : [https://gitlab.binets.fr/br/qdj/-/blob/master/deployment/Dockerfile?ref_type=heads qdj-Dockerfile]

<div lang="fr" dir="ltr" class="mw-content-ltr">
A ''Docker container'' is an isolated machine on which you can run your website. In this step, we will help you convert you app to be Docker-ready. This basically means installing everything your app needs inside a linux computer. You'll need to install ''Docker'' on your computer first [https://docs.docker.com/desktop/install/windows-install/ windows-installer].
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
We assume your project is hosted on the [https://gitlab.binets.fr BR's gitlab instance]. Create a <code>deployment</code> directory at the root of your repository and create a file <code>Dockerfile</code> (with no extension) and a file <code>docker-compose.yaml</code> in it.
</div>

* Dockerfile
<source lang="yaml">
FROM hello-world
</source>

* docker-compose.yaml
<source lang="yaml">
# this is a docker-compose meant for local testing of the deployment image.
# for the real deployment, go to the docker-services BR gitlab project

version: "3"
services:
app:
build:
context: ..
dockerfile: deployment/Dockerfile
# ports:
# - "8000:8000"
</source>

<div lang="fr" dir="ltr" class="mw-content-ltr">
Then open a terminal in this directory and type <code>docker compose up --build</code>. If everything went well, you see a nice message from Docker telling you everything is working !
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
Now, you need to make ''your'' app work in the docker container. For this, you need:
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
* To update the Dockerfile to install everything you need. The following works for a basic (Django) python app :
</div>
<source>
FROM python:3

# copies all the code inside the container
COPY . /my_super_project

WORKDIR /my_super_project
RUN pip install --no-cache-dir -r requirements.txt
CMD python3 manage.py runserver
</source>

* To update the docker-compose file to expose the port you need (uncomment the corresponding line in the dockerfile).

=== How to handle persistant data ===

If you app uses an external database or need to not lose some files accross resets, you should use ''docker volumes'' with or without a ''postgres'' image. The [https://gitlab.binets.fr/br/docker-services/-/blob/master/docker-compose.site-jtx.yml?ref_type=heads jtx-docker-compose] might help you understand what you need.

=== How to handle secrets ===

Often your app has some secrets in a file (such as ''.env'') that is not in Git. DO NOT put it in git (or all your secrets will be stolen !). Later we are going to see how to securely make them available for the automatic gitlab build.

== Automatic build ==

We will you ''gitlab continuous integration'' to build your docker image directly on the BR's servers. Write the following into a file name <code>.gitlab-ci.yml</code> at the root of your repository :

<source lang="yaml"># Build docker image and upload to registry
variables:
IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_PIPELINE_IID
PROJECT: mySuperProject

docker:build:
stage: build
only: # put here the git branches you want the job to run on :
- main
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
DOCKER_TLS_CERTDIR: '' # disables TLS in docker-in-docker (not needed)
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG
</source>

As you commit this file to Gitlab, you should see a new job appear (or look under Build/jobs). Your image should build correctly (if not, it means something is not available to gitlab that is when you build on your computer. Read the job logs and try to fix it !)

=== Checking the image ===

This step is optional, but it is the easiest way to debug your image ! You can run it locally like so :

<source lang=bash>
docker login registry.binets.fr
docker run --rm registry.binets.fr/<nom.prenom>/<my-gitlab-repo>:<image>
</source>

Where <code>image</code> is the number of the image (available in <code>Gitlab -> Deploy -> Container registry</code>) and <code><nom.prenom>/<my-gitlab-repo></code> is the same as in your project Gitlab URL.

Typically, your app won't start because you forgot a secret file (see below how to manage that !).

== Automatic deployment ==

We will now add a second CI job to your repository to deploy your image. It will trigger ''another'' CI pipeline of [https://gitlab.binets.fr/br/docker-services br/docker-services]. This pipeline has the rights to deploy on <code>endalcher</code>, and does so using a <code>docker-compose.yaml</code> file. To trigger it, add the following to your <code>.gitlab-ci.yml</code>

<source lang=yaml>
docker:deploy:
stage: deploy
only:
- stable
image: debian:latest
when: manual
script:
- apt-get update && apt-get install -y curl
- curl --fail-with-body --request POST --form token=$TRIGGER_TOKEN --form ref=master --form variables[PROJECT]=$PROJECT --form variables[DOCKER_IMAGE]=$IMAGE_TAG https://gitlab.binets.fr/api/v4/projects/560/trigger/pipeline
</source>

Make sure the variable <code>PROJECT</code> in <code>.gitlab-ci.yml</code> is correct : our pipeline will deploy the file named <code>docker-compose.${PROJECT}.yaml</code>.

In order to create the correct <code>docker-compose.${PROJECT}.yaml</code> file, you will need to create a Merge Request on [https://gitlab.binets.fr/br/docker-services br/docker-services], or send a <code>docker-compose.yaml</code> file to a BRman. The [https://gitlab.binets.fr/br/docker-services br/docker-services] is full of examples and a basic one is explained below :

=== Extra parameters and secrets ===

''Be aware that any secret passed this way is still visible to the BR and everyone that has maintainer access to you repository ! If you need help setting up, don't hesitate to ask for help from the BR !''

You can also pass any parameter needed in the compose file by adding arguments to the cURL call like so : <code>--form variables[MY_SUPER_VARIABLE]="elle vaut 42!"</code>

If you want to pass secret environnements variables, store them in <code>Gitlab -> Settings -> CI-CD -> Variables</code> and make sure they are "protected" and "masked". Pass them like so <code>--form variables[MY_PASSWORD]=$PASSWORD_STORED_IN_GITLAB</code>.

=== Secret files ===

''Be aware that any secret passed this way too is visible to the BR and everyone that has ''ANY'' access to you repository (because they can get the docker image) ! So only do this for a private registry or make sure your setting <code>Settings -> General -> Visibility, project features, permissions</code> only allows for registry access for members''

Another way to store secrets in your Gitlab repo is <code>Gitlab -> Settings -> CI-CD -> Secure-files</code>. You can upload any (small) secret file here and it will not be exposed ! You can downlod it at buildtime like so :

<source lang=yaml>
# Build docker image and upload to registry
docker:build:
stage: build
only:
- main
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
# For disabling TLS in docker-in-docker (not needed)
DOCKER_TLS_CERTDIR: ""
# !!! where to download our secure .env file
SECURE_FILES_DOWNLOAD_PATH: "."
script:
# !!! download secure .env file
- apk add --no-cache curl bash
- curl --silent "https://gitlab.com/gitlab-org/incubation-engineering/mobile-devops/download-secure-files/-/raw/main/installer" | bash
# build docker image
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG
- echo "=> pushed $IMAGE_TAG"
</source>

=== Private repository ===

Keeping your repository private can be beneficial for security or privacy. But it require an extra step for the BR to access the docker image. We wille pass a [https://docs.gitlab.com/ee/user/project/deploy_tokens/#gitlab-deploy-token CI deploy token] as cURL parameter.

* Go to your <code>Settings -> Repository -> Deploy token</code> and create a token name exactly <code>gitlab-deploy-token</code>

* Add the following parameters to the cURL call in your CI deploy job : <code> --form variables[OPTIONAL_PRIVATE_CI_REGISTRY]=$CI_REGISTRY --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_USER]=$CI_DEPLOY_USER --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_PASSWORD]=$CI_DEPLOY_PASSWORD </code>

== Example ==

You want to deploy the QDJ site with docker, and bind it to the server name <code>qdj.binets.fr</code>. Your site is running on flask and uses a postgresql database.

=== Pre-existant configuration ===

You have a little <code>Dockerfile</code>:

<pre># Base image: python3
FROM python:3
WORKDIR /usr/src/app

# Install dependacies
COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt

# Copy application files
COPY . .

EXPOSE 5000/tcp

# the command runs the migrations and then launches gunicorn to serve the app
CMD python -m flask db upgrade && gunicorn -b :5000 qdj:app</pre>
You have the following <code>docker-compose.yaml</code>:

<source lang="yaml">version: '3.1'

services:
db:
# Use a small postgres image, as we don't need anything on this container
image: postgres:alpine
environment:
POSTGRES_USER: qdj
POSTGRES_PASSWORD: somepassword
POSTGRES_DB: qdj
# store the data on a persistent file
volumes:
- "qdj-data:/var/lib/postgresql/data"
restart: always

app:
# Use the image from Dockerfile
image: ${DOCKER_IMAGE}
environment:
FLASK_APP: qdj.py
FLASK_ENV: production
FLASK_DEBUG: 0
DATABASE_URI: "postgresql://qdj:somepassword@db:5432/qdj"
SECRET_KEY:
# Tells to docker to start app after db (otherwise flask crashes)
depends_on:
- db
# Always restart on crash
restart: always

volumes:
qdj-data:</source>
=== Production <code>docker-compose.yaml</code> ===

We will adapt your <code>docker-compose.yaml</code> file in order to bind your site to the hostname :

<ol>
<li>First let's connect your <code>app</code> container to the global network. We won't bind the <code>db</code> container to the global network to protect it from intruders. [[File:https://cloud.binets.fr/s/QTgY55AapFDTyyW/preview|Network graph in endalcher]] We will add network configuration to the <code>docker-compose.yaml</code>:
<ul>
<li><p>to enable the network <code>web</code>, we add at the bottom of the file:</p>
<source lang="yaml">networks:
web:
external: true</source></li>
<li><p>to connect <code>app</code> to the network <code>web</code>, we add to the <code>app</code> configuration:</p>
<source lang="yaml">networks:
- web
- default</source></li></ul>
</li>
<li><p>Then we can add labels to tell <code>traefik</code> to match the hostname to a packet going to <code>app</code>:</p>
<source lang="yaml">labels:
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:qdj.binets.fr"
- "traefik.port=5000"</source></li></ol>

This gives us the following <code>docker-compose.qdj.yaml</code>:

<source lang="yaml">version: '3.1'

services:

db:
image: postgres:alpine
restart: always
environment:
POSTGRES_USER: qdj
POSTGRES_PASSWORD: qdjpw
POSTGRES_DB: qdj
volumes:
- "qdj-data:/var/lib/postgresql/data"

app:
image: ${DOCKER_IMAGE}
environment:
FLASK_APP: qdj.py
FLASK_ENV: production
FLASK_DEBUG: 0
DATABASE_URI: "postgresql://qdj:qdjpw@db:5432/qdj"
SECRET_KEY:
depends_on:
- db
restart: always
networks:
- web
- default
labels:
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:qdj.binets.fr"
- "traefik.port=5000"

volumes:
qdj-data:

networks:
web:
external: true</source>
This file goes into the [https://gitlab.binets.fr/br/docker-services br/docker-services] repository, it will be used by the triggered pipeline to create your containers.

=== Triggering pipelines with Gitlab CI ===

In this pipeline, we will need to add 2 jobs:

* one to build the docker image using the <code>Dockerfile</code>
* one to trigger the [https://gitlab.binets.fr/br/docker-services br/docker-services] pipeline to create the containers.

To build the docker image, we will use the template do so:

<source lang="yaml"># Build docker image and upload to registry
docker:build:
stage: build
only:
- master
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
# For disabling TLS in docker-in-docker (not needed)
DOCKER_TLS_CERTDIR: ''
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG</source>
The second job is rather tricky. We will use <code>curl</code> to trigger the pipeline, using [https://docs.gitlab.com/ce/ci/triggers/README.html Gitlab Pipeline API]. This call is secured by a trigger token, which should be saved into your project variables as <code>$TRIGGER_TOKEN</code>. This is what the job looks like:

<source lang="yaml">docker:deploy:
stage: deploy
when: manual
script:
- apt-get update && apt-get install -y curl
- curl --request POST --form token=$TRIGGER_TOKEN --form ref=master --form variables[PROJECT]=qdj --form variables[DOCKER_IMAGE]=$IMAGE_TAG https://gitlab.binets.fr/api/v4/projects/560/trigger/pipeline</source>
Pay attention to this syntax because debugging this api call takes a lot of time...

If you want to add variables that will be used in your <code>docker-compose.yaml</code>, add other arguments to <code>curl</code> like <code>--form variables[WELCOME_MESSAGE]="Hello World!"</code>.

You can see an example of a CI using this in the [https://gitlab.binets.fr/br/qdj br/qdj] repo.

Note: for BR project, you can use the <code>trigger</code> syntax in the API call since you don't need autorisation.

== History ==

* In 2017, the BR16 set up a [https://kubernetes.io/ Kubernetes] cluster. They managed to set up a workflow to deploy seamlessly from gitlab on that cluster. However, the configuration was hard to maintain and the BR17 was not able to keep it going.
* In 2018, the BR17 (Oliver Facklam + Hadrien Renaud) set up a small docker service on a computer from the Salle Informatiques

= Developping a site for BR docker deployement =

Docker allows for most technologies to be abstracted into a container and thus most - if not all - sites can be deployed in docker. However, here is a bit of advice to make deployement less painful :

* Before using a particular external service (something that should run in a seperate container), check that a well supported docker image exists and with a BRman that there are no other constraints (for example, using a MinIO will go through a seperate dedicated server that already exists rather than a container).
* Use a postgres database to get access to an admin website for your server.

Translations:Tuto pour le déploiement des sites avec Docker/12/en

2026-08-05T12:40:44Z

The exact procedure will be dependant on your project. An example can be found here : [https://gitlab.binets.fr/br/qdj/-/blob/master/deployment/Dockerfile?ref_type=heads qdj-Dockerfile]

Tuto pour le déploiement des sites avec Docker/en

2026-08-05T12:40:39Z

Daniela.cojocaru : Page créée avec « == How to convert your website to a Docker service == »

At the end of this tutorial you will be able to deploy your website (or service) on the servers of the BR! This allows you to benefit from a free, high-performance and robust infrastructure!

Note: this tutorial may be a bit tricky, so please don’t hesitate to get in touch with a BRman to get help.

<span id="Comment_déployer_des_conteneurs_Docker_sur_l'infrastructure_du_BR"></span>
= How to deploy Docker containers on the infrastructure of the BR =

== Overview ==

This tutorial will walk you through :
* How to convert your website to a Docker service
* How to build it automatically on Gitlab-CI
* How to deploy it automatically on our servers

== Requirements ==

* Basics of git (videos [https://git-scm.com/video/what-is-version-control here] or the beginning of [https://git-scm.com/book/en/v2 this awesome online book]) ;
* Basics of containers (see a really good explanation [https://www.docker.com/resources/what-container here]) and of docker-compose (see the getting-started [https://docs.docker.com/compose/gettingstarted/ here]) ;
* Basics of web (see an [https://developer.mozilla.org/en-US/docs/Learn/Getting_started_with_the_web/How_the_Web_works introduction] on MDN) ;
* Basics of gitlab-ci (reading the [https://docs.gitlab.com/ee/ci/ getting-started] is recommended) ;

== Existing architecture ==

A physical server called <code>endalcher</code> deploys and runs your container. It uses the following services to connect your service to the Interne:

* [https://docs.docker.com/compose/ docker-compose] to deploy the correct environment for your containers ;
* [https://docs.traefik.io/v1.7/ traefik] as a reverse proxy to serve your site behind your endpoint, it is configured [https://gitlab.binets.fr/br/docker-default-services here] ;
* nginx to serve your site to the outside world (as all the binets sites).

== How to convert your website to a Docker service ==

<div lang="fr" dir="ltr" class="mw-content-ltr">
The exact procedure will be dependant on your project. An example can be found here : [https://gitlab.binets.fr/br/qdj/-/blob/master/deployment/Dockerfile?ref_type=heads qdj-Dockerfile]
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
A ''Docker container'' is an isolated machine on which you can run your website. In this step, we will help you convert you app to be Docker-ready. This basically means installing everything your app needs inside a linux computer. You'll need to install ''Docker'' on your computer first [https://docs.docker.com/desktop/install/windows-install/ windows-installer].
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
We assume your project is hosted on the [https://gitlab.binets.fr BR's gitlab instance]. Create a <code>deployment</code> directory at the root of your repository and create a file <code>Dockerfile</code> (with no extension) and a file <code>docker-compose.yaml</code> in it.
</div>

* Dockerfile
<source lang="yaml">
FROM hello-world
</source>

* docker-compose.yaml
<source lang="yaml">
# this is a docker-compose meant for local testing of the deployment image.
# for the real deployment, go to the docker-services BR gitlab project

version: "3"
services:
app:
build:
context: ..
dockerfile: deployment/Dockerfile
# ports:
# - "8000:8000"
</source>

<div lang="fr" dir="ltr" class="mw-content-ltr">
Then open a terminal in this directory and type <code>docker compose up --build</code>. If everything went well, you see a nice message from Docker telling you everything is working !
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
Now, you need to make ''your'' app work in the docker container. For this, you need:
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
* To update the Dockerfile to install everything you need. The following works for a basic (Django) python app :
</div>
<source>
FROM python:3

# copies all the code inside the container
COPY . /my_super_project

WORKDIR /my_super_project
RUN pip install --no-cache-dir -r requirements.txt
CMD python3 manage.py runserver
</source>

* To update the docker-compose file to expose the port you need (uncomment the corresponding line in the dockerfile).

=== How to handle persistant data ===

If you app uses an external database or need to not lose some files accross resets, you should use ''docker volumes'' with or without a ''postgres'' image. The [https://gitlab.binets.fr/br/docker-services/-/blob/master/docker-compose.site-jtx.yml?ref_type=heads jtx-docker-compose] might help you understand what you need.

=== How to handle secrets ===

Often your app has some secrets in a file (such as ''.env'') that is not in Git. DO NOT put it in git (or all your secrets will be stolen !). Later we are going to see how to securely make them available for the automatic gitlab build.

== Automatic build ==

We will you ''gitlab continuous integration'' to build your docker image directly on the BR's servers. Write the following into a file name <code>.gitlab-ci.yml</code> at the root of your repository :

<source lang="yaml"># Build docker image and upload to registry
variables:
IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_PIPELINE_IID
PROJECT: mySuperProject

docker:build:
stage: build
only: # put here the git branches you want the job to run on :
- main
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
DOCKER_TLS_CERTDIR: '' # disables TLS in docker-in-docker (not needed)
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG
</source>

As you commit this file to Gitlab, you should see a new job appear (or look under Build/jobs). Your image should build correctly (if not, it means something is not available to gitlab that is when you build on your computer. Read the job logs and try to fix it !)

=== Checking the image ===

This step is optional, but it is the easiest way to debug your image ! You can run it locally like so :

<source lang=bash>
docker login registry.binets.fr
docker run --rm registry.binets.fr/<nom.prenom>/<my-gitlab-repo>:<image>
</source>

Where <code>image</code> is the number of the image (available in <code>Gitlab -> Deploy -> Container registry</code>) and <code><nom.prenom>/<my-gitlab-repo></code> is the same as in your project Gitlab URL.

Typically, your app won't start because you forgot a secret file (see below how to manage that !).

== Automatic deployment ==

We will now add a second CI job to your repository to deploy your image. It will trigger ''another'' CI pipeline of [https://gitlab.binets.fr/br/docker-services br/docker-services]. This pipeline has the rights to deploy on <code>endalcher</code>, and does so using a <code>docker-compose.yaml</code> file. To trigger it, add the following to your <code>.gitlab-ci.yml</code>

<source lang=yaml>
docker:deploy:
stage: deploy
only:
- stable
image: debian:latest
when: manual
script:
- apt-get update && apt-get install -y curl
- curl --fail-with-body --request POST --form token=$TRIGGER_TOKEN --form ref=master --form variables[PROJECT]=$PROJECT --form variables[DOCKER_IMAGE]=$IMAGE_TAG https://gitlab.binets.fr/api/v4/projects/560/trigger/pipeline
</source>

Make sure the variable <code>PROJECT</code> in <code>.gitlab-ci.yml</code> is correct : our pipeline will deploy the file named <code>docker-compose.${PROJECT}.yaml</code>.

In order to create the correct <code>docker-compose.${PROJECT}.yaml</code> file, you will need to create a Merge Request on [https://gitlab.binets.fr/br/docker-services br/docker-services], or send a <code>docker-compose.yaml</code> file to a BRman. The [https://gitlab.binets.fr/br/docker-services br/docker-services] is full of examples and a basic one is explained below :

=== Extra parameters and secrets ===

''Be aware that any secret passed this way is still visible to the BR and everyone that has maintainer access to you repository ! If you need help setting up, don't hesitate to ask for help from the BR !''

You can also pass any parameter needed in the compose file by adding arguments to the cURL call like so : <code>--form variables[MY_SUPER_VARIABLE]="elle vaut 42!"</code>

If you want to pass secret environnements variables, store them in <code>Gitlab -> Settings -> CI-CD -> Variables</code> and make sure they are "protected" and "masked". Pass them like so <code>--form variables[MY_PASSWORD]=$PASSWORD_STORED_IN_GITLAB</code>.

=== Secret files ===

''Be aware that any secret passed this way too is visible to the BR and everyone that has ''ANY'' access to you repository (because they can get the docker image) ! So only do this for a private registry or make sure your setting <code>Settings -> General -> Visibility, project features, permissions</code> only allows for registry access for members''

Another way to store secrets in your Gitlab repo is <code>Gitlab -> Settings -> CI-CD -> Secure-files</code>. You can upload any (small) secret file here and it will not be exposed ! You can downlod it at buildtime like so :

<source lang=yaml>
# Build docker image and upload to registry
docker:build:
stage: build
only:
- main
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
# For disabling TLS in docker-in-docker (not needed)
DOCKER_TLS_CERTDIR: ""
# !!! where to download our secure .env file
SECURE_FILES_DOWNLOAD_PATH: "."
script:
# !!! download secure .env file
- apk add --no-cache curl bash
- curl --silent "https://gitlab.com/gitlab-org/incubation-engineering/mobile-devops/download-secure-files/-/raw/main/installer" | bash
# build docker image
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG
- echo "=> pushed $IMAGE_TAG"
</source>

=== Private repository ===

Keeping your repository private can be beneficial for security or privacy. But it require an extra step for the BR to access the docker image. We wille pass a [https://docs.gitlab.com/ee/user/project/deploy_tokens/#gitlab-deploy-token CI deploy token] as cURL parameter.

* Go to your <code>Settings -> Repository -> Deploy token</code> and create a token name exactly <code>gitlab-deploy-token</code>

* Add the following parameters to the cURL call in your CI deploy job : <code> --form variables[OPTIONAL_PRIVATE_CI_REGISTRY]=$CI_REGISTRY --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_USER]=$CI_DEPLOY_USER --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_PASSWORD]=$CI_DEPLOY_PASSWORD </code>

== Example ==

You want to deploy the QDJ site with docker, and bind it to the server name <code>qdj.binets.fr</code>. Your site is running on flask and uses a postgresql database.

=== Pre-existant configuration ===

You have a little <code>Dockerfile</code>:

<pre># Base image: python3
FROM python:3
WORKDIR /usr/src/app

# Install dependacies
COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt

# Copy application files
COPY . .

EXPOSE 5000/tcp

# the command runs the migrations and then launches gunicorn to serve the app
CMD python -m flask db upgrade && gunicorn -b :5000 qdj:app</pre>
You have the following <code>docker-compose.yaml</code>:

<source lang="yaml">version: '3.1'

services:
db:
# Use a small postgres image, as we don't need anything on this container
image: postgres:alpine
environment:
POSTGRES_USER: qdj
POSTGRES_PASSWORD: somepassword
POSTGRES_DB: qdj
# store the data on a persistent file
volumes:
- "qdj-data:/var/lib/postgresql/data"
restart: always

app:
# Use the image from Dockerfile
image: ${DOCKER_IMAGE}
environment:
FLASK_APP: qdj.py
FLASK_ENV: production
FLASK_DEBUG: 0
DATABASE_URI: "postgresql://qdj:somepassword@db:5432/qdj"
SECRET_KEY:
# Tells to docker to start app after db (otherwise flask crashes)
depends_on:
- db
# Always restart on crash
restart: always

volumes:
qdj-data:</source>
=== Production <code>docker-compose.yaml</code> ===

We will adapt your <code>docker-compose.yaml</code> file in order to bind your site to the hostname :

<ol>
<li>First let's connect your <code>app</code> container to the global network. We won't bind the <code>db</code> container to the global network to protect it from intruders. [[File:https://cloud.binets.fr/s/QTgY55AapFDTyyW/preview|Network graph in endalcher]] We will add network configuration to the <code>docker-compose.yaml</code>:
<ul>
<li><p>to enable the network <code>web</code>, we add at the bottom of the file:</p>
<source lang="yaml">networks:
web:
external: true</source></li>
<li><p>to connect <code>app</code> to the network <code>web</code>, we add to the <code>app</code> configuration:</p>
<source lang="yaml">networks:
- web
- default</source></li></ul>
</li>
<li><p>Then we can add labels to tell <code>traefik</code> to match the hostname to a packet going to <code>app</code>:</p>
<source lang="yaml">labels:
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:qdj.binets.fr"
- "traefik.port=5000"</source></li></ol>

This gives us the following <code>docker-compose.qdj.yaml</code>:

<source lang="yaml">version: '3.1'

services:

db:
image: postgres:alpine
restart: always
environment:
POSTGRES_USER: qdj
POSTGRES_PASSWORD: qdjpw
POSTGRES_DB: qdj
volumes:
- "qdj-data:/var/lib/postgresql/data"

app:
image: ${DOCKER_IMAGE}
environment:
FLASK_APP: qdj.py
FLASK_ENV: production
FLASK_DEBUG: 0
DATABASE_URI: "postgresql://qdj:qdjpw@db:5432/qdj"
SECRET_KEY:
depends_on:
- db
restart: always
networks:
- web
- default
labels:
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:qdj.binets.fr"
- "traefik.port=5000"

volumes:
qdj-data:

networks:
web:
external: true</source>
This file goes into the [https://gitlab.binets.fr/br/docker-services br/docker-services] repository, it will be used by the triggered pipeline to create your containers.

=== Triggering pipelines with Gitlab CI ===

In this pipeline, we will need to add 2 jobs:

* one to build the docker image using the <code>Dockerfile</code>
* one to trigger the [https://gitlab.binets.fr/br/docker-services br/docker-services] pipeline to create the containers.

To build the docker image, we will use the template do so:

<source lang="yaml"># Build docker image and upload to registry
docker:build:
stage: build
only:
- master
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
# For disabling TLS in docker-in-docker (not needed)
DOCKER_TLS_CERTDIR: ''
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG</source>
The second job is rather tricky. We will use <code>curl</code> to trigger the pipeline, using [https://docs.gitlab.com/ce/ci/triggers/README.html Gitlab Pipeline API]. This call is secured by a trigger token, which should be saved into your project variables as <code>$TRIGGER_TOKEN</code>. This is what the job looks like:

<source lang="yaml">docker:deploy:
stage: deploy
when: manual
script:
- apt-get update && apt-get install -y curl
- curl --request POST --form token=$TRIGGER_TOKEN --form ref=master --form variables[PROJECT]=qdj --form variables[DOCKER_IMAGE]=$IMAGE_TAG https://gitlab.binets.fr/api/v4/projects/560/trigger/pipeline</source>
Pay attention to this syntax because debugging this api call takes a lot of time...

If you want to add variables that will be used in your <code>docker-compose.yaml</code>, add other arguments to <code>curl</code> like <code>--form variables[WELCOME_MESSAGE]="Hello World!"</code>.

You can see an example of a CI using this in the [https://gitlab.binets.fr/br/qdj br/qdj] repo.

Note: for BR project, you can use the <code>trigger</code> syntax in the API call since you don't need autorisation.

== History ==

* In 2017, the BR16 set up a [https://kubernetes.io/ Kubernetes] cluster. They managed to set up a workflow to deploy seamlessly from gitlab on that cluster. However, the configuration was hard to maintain and the BR17 was not able to keep it going.
* In 2018, the BR17 (Oliver Facklam + Hadrien Renaud) set up a small docker service on a computer from the Salle Informatiques

= Developping a site for BR docker deployement =

Docker allows for most technologies to be abstracted into a container and thus most - if not all - sites can be deployed in docker. However, here is a bit of advice to make deployement less painful :

* Before using a particular external service (something that should run in a seperate container), check that a well supported docker image exists and with a BRman that there are no other constraints (for example, using a MinIO will go through a seperate dedicated server that already exists rather than a container).
* Use a postgres database to get access to an admin website for your server.

Translations:Tuto pour le déploiement des sites avec Docker/11/en

2026-08-05T12:40:37Z

Daniela.cojocaru : Page créée avec « == How to convert your website to a Docker service == »

== How to convert your website to a Docker service ==

Translations:Tuto pour le déploiement des sites avec Docker/10/en

2026-08-05T12:40:30Z

Daniela.cojocaru : Page créée avec « * [https://docs.docker.com/compose/ docker-compose] to deploy the correct environment for your containers ; * [https://docs.traefik.io/v1.7/ traefik] as a reverse proxy to serve your site behind your endpoint, it is configured [https://gitlab.binets.fr/br/docker-default-services here] ; * nginx to serve your site to the outside world (as all the binets sites). »

* [https://docs.docker.com/compose/ docker-compose] to deploy the correct environment for your containers ;
* [https://docs.traefik.io/v1.7/ traefik] as a reverse proxy to serve your site behind your endpoint, it is configured [https://gitlab.binets.fr/br/docker-default-services here] ;
* nginx to serve your site to the outside world (as all the binets sites).

Tuto pour le déploiement des sites avec Docker/en

2026-08-05T12:40:20Z

Daniela.cojocaru : Page créée avec « A physical server called <code>endalcher</code> deploys and runs your container. It uses the following services to connect your service to the Interne: »

At the end of this tutorial you will be able to deploy your website (or service) on the servers of the BR! This allows you to benefit from a free, high-performance and robust infrastructure!

Note: this tutorial may be a bit tricky, so please don’t hesitate to get in touch with a BRman to get help.

<span id="Comment_déployer_des_conteneurs_Docker_sur_l'infrastructure_du_BR"></span>
= How to deploy Docker containers on the infrastructure of the BR =

== Overview ==

This tutorial will walk you through :
* How to convert your website to a Docker service
* How to build it automatically on Gitlab-CI
* How to deploy it automatically on our servers

== Requirements ==

* Basics of git (videos [https://git-scm.com/video/what-is-version-control here] or the beginning of [https://git-scm.com/book/en/v2 this awesome online book]) ;
* Basics of containers (see a really good explanation [https://www.docker.com/resources/what-container here]) and of docker-compose (see the getting-started [https://docs.docker.com/compose/gettingstarted/ here]) ;
* Basics of web (see an [https://developer.mozilla.org/en-US/docs/Learn/Getting_started_with_the_web/How_the_Web_works introduction] on MDN) ;
* Basics of gitlab-ci (reading the [https://docs.gitlab.com/ee/ci/ getting-started] is recommended) ;

== Existing architecture ==

A physical server called <code>endalcher</code> deploys and runs your container. It uses the following services to connect your service to the Interne:

<div lang="fr" dir="ltr" class="mw-content-ltr">
* [https://docs.docker.com/compose/ docker-compose] to deploy the correct environment for your containers ;
* [https://docs.traefik.io/v1.7/ traefik] as a reverse proxy to serve your site behind your endpoint, it is configured [https://gitlab.binets.fr/br/docker-default-services here] ;
* nginx to serve your site to the outside world (as all the binets sites).
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
== How to convert your website to a Docker service ==
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
The exact procedure will be dependant on your project. An example can be found here : [https://gitlab.binets.fr/br/qdj/-/blob/master/deployment/Dockerfile?ref_type=heads qdj-Dockerfile]
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
A ''Docker container'' is an isolated machine on which you can run your website. In this step, we will help you convert you app to be Docker-ready. This basically means installing everything your app needs inside a linux computer. You'll need to install ''Docker'' on your computer first [https://docs.docker.com/desktop/install/windows-install/ windows-installer].
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
We assume your project is hosted on the [https://gitlab.binets.fr BR's gitlab instance]. Create a <code>deployment</code> directory at the root of your repository and create a file <code>Dockerfile</code> (with no extension) and a file <code>docker-compose.yaml</code> in it.
</div>

* Dockerfile
<source lang="yaml">
FROM hello-world
</source>

* docker-compose.yaml
<source lang="yaml">
# this is a docker-compose meant for local testing of the deployment image.
# for the real deployment, go to the docker-services BR gitlab project

version: "3"
services:
app:
build:
context: ..
dockerfile: deployment/Dockerfile
# ports:
# - "8000:8000"
</source>

<div lang="fr" dir="ltr" class="mw-content-ltr">
Then open a terminal in this directory and type <code>docker compose up --build</code>. If everything went well, you see a nice message from Docker telling you everything is working !
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
Now, you need to make ''your'' app work in the docker container. For this, you need:
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
* To update the Dockerfile to install everything you need. The following works for a basic (Django) python app :
</div>
<source>
FROM python:3

# copies all the code inside the container
COPY . /my_super_project

WORKDIR /my_super_project
RUN pip install --no-cache-dir -r requirements.txt
CMD python3 manage.py runserver
</source>

* To update the docker-compose file to expose the port you need (uncomment the corresponding line in the dockerfile).

=== How to handle persistant data ===

If you app uses an external database or need to not lose some files accross resets, you should use ''docker volumes'' with or without a ''postgres'' image. The [https://gitlab.binets.fr/br/docker-services/-/blob/master/docker-compose.site-jtx.yml?ref_type=heads jtx-docker-compose] might help you understand what you need.

=== How to handle secrets ===

Often your app has some secrets in a file (such as ''.env'') that is not in Git. DO NOT put it in git (or all your secrets will be stolen !). Later we are going to see how to securely make them available for the automatic gitlab build.

== Automatic build ==

We will you ''gitlab continuous integration'' to build your docker image directly on the BR's servers. Write the following into a file name <code>.gitlab-ci.yml</code> at the root of your repository :

<source lang="yaml"># Build docker image and upload to registry
variables:
IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_PIPELINE_IID
PROJECT: mySuperProject

docker:build:
stage: build
only: # put here the git branches you want the job to run on :
- main
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
DOCKER_TLS_CERTDIR: '' # disables TLS in docker-in-docker (not needed)
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG
</source>

As you commit this file to Gitlab, you should see a new job appear (or look under Build/jobs). Your image should build correctly (if not, it means something is not available to gitlab that is when you build on your computer. Read the job logs and try to fix it !)

=== Checking the image ===

This step is optional, but it is the easiest way to debug your image ! You can run it locally like so :

<source lang=bash>
docker login registry.binets.fr
docker run --rm registry.binets.fr/<nom.prenom>/<my-gitlab-repo>:<image>
</source>

Where <code>image</code> is the number of the image (available in <code>Gitlab -> Deploy -> Container registry</code>) and <code><nom.prenom>/<my-gitlab-repo></code> is the same as in your project Gitlab URL.

Typically, your app won't start because you forgot a secret file (see below how to manage that !).

== Automatic deployment ==

We will now add a second CI job to your repository to deploy your image. It will trigger ''another'' CI pipeline of [https://gitlab.binets.fr/br/docker-services br/docker-services]. This pipeline has the rights to deploy on <code>endalcher</code>, and does so using a <code>docker-compose.yaml</code> file. To trigger it, add the following to your <code>.gitlab-ci.yml</code>

<source lang=yaml>
docker:deploy:
stage: deploy
only:
- stable
image: debian:latest
when: manual
script:
- apt-get update && apt-get install -y curl
- curl --fail-with-body --request POST --form token=$TRIGGER_TOKEN --form ref=master --form variables[PROJECT]=$PROJECT --form variables[DOCKER_IMAGE]=$IMAGE_TAG https://gitlab.binets.fr/api/v4/projects/560/trigger/pipeline
</source>

Make sure the variable <code>PROJECT</code> in <code>.gitlab-ci.yml</code> is correct : our pipeline will deploy the file named <code>docker-compose.${PROJECT}.yaml</code>.

In order to create the correct <code>docker-compose.${PROJECT}.yaml</code> file, you will need to create a Merge Request on [https://gitlab.binets.fr/br/docker-services br/docker-services], or send a <code>docker-compose.yaml</code> file to a BRman. The [https://gitlab.binets.fr/br/docker-services br/docker-services] is full of examples and a basic one is explained below :

=== Extra parameters and secrets ===

''Be aware that any secret passed this way is still visible to the BR and everyone that has maintainer access to you repository ! If you need help setting up, don't hesitate to ask for help from the BR !''

You can also pass any parameter needed in the compose file by adding arguments to the cURL call like so : <code>--form variables[MY_SUPER_VARIABLE]="elle vaut 42!"</code>

If you want to pass secret environnements variables, store them in <code>Gitlab -> Settings -> CI-CD -> Variables</code> and make sure they are "protected" and "masked". Pass them like so <code>--form variables[MY_PASSWORD]=$PASSWORD_STORED_IN_GITLAB</code>.

=== Secret files ===

''Be aware that any secret passed this way too is visible to the BR and everyone that has ''ANY'' access to you repository (because they can get the docker image) ! So only do this for a private registry or make sure your setting <code>Settings -> General -> Visibility, project features, permissions</code> only allows for registry access for members''

Another way to store secrets in your Gitlab repo is <code>Gitlab -> Settings -> CI-CD -> Secure-files</code>. You can upload any (small) secret file here and it will not be exposed ! You can downlod it at buildtime like so :

<source lang=yaml>
# Build docker image and upload to registry
docker:build:
stage: build
only:
- main
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
# For disabling TLS in docker-in-docker (not needed)
DOCKER_TLS_CERTDIR: ""
# !!! where to download our secure .env file
SECURE_FILES_DOWNLOAD_PATH: "."
script:
# !!! download secure .env file
- apk add --no-cache curl bash
- curl --silent "https://gitlab.com/gitlab-org/incubation-engineering/mobile-devops/download-secure-files/-/raw/main/installer" | bash
# build docker image
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG
- echo "=> pushed $IMAGE_TAG"
</source>

=== Private repository ===

Keeping your repository private can be beneficial for security or privacy. But it require an extra step for the BR to access the docker image. We wille pass a [https://docs.gitlab.com/ee/user/project/deploy_tokens/#gitlab-deploy-token CI deploy token] as cURL parameter.

* Go to your <code>Settings -> Repository -> Deploy token</code> and create a token name exactly <code>gitlab-deploy-token</code>

* Add the following parameters to the cURL call in your CI deploy job : <code> --form variables[OPTIONAL_PRIVATE_CI_REGISTRY]=$CI_REGISTRY --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_USER]=$CI_DEPLOY_USER --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_PASSWORD]=$CI_DEPLOY_PASSWORD </code>

== Example ==

You want to deploy the QDJ site with docker, and bind it to the server name <code>qdj.binets.fr</code>. Your site is running on flask and uses a postgresql database.

=== Pre-existant configuration ===

You have a little <code>Dockerfile</code>:

<pre># Base image: python3
FROM python:3
WORKDIR /usr/src/app

# Install dependacies
COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt

# Copy application files
COPY . .

EXPOSE 5000/tcp

# the command runs the migrations and then launches gunicorn to serve the app
CMD python -m flask db upgrade && gunicorn -b :5000 qdj:app</pre>
You have the following <code>docker-compose.yaml</code>:

<source lang="yaml">version: '3.1'

services:
db:
# Use a small postgres image, as we don't need anything on this container
image: postgres:alpine
environment:
POSTGRES_USER: qdj
POSTGRES_PASSWORD: somepassword
POSTGRES_DB: qdj
# store the data on a persistent file
volumes:
- "qdj-data:/var/lib/postgresql/data"
restart: always

app:
# Use the image from Dockerfile
image: ${DOCKER_IMAGE}
environment:
FLASK_APP: qdj.py
FLASK_ENV: production
FLASK_DEBUG: 0
DATABASE_URI: "postgresql://qdj:somepassword@db:5432/qdj"
SECRET_KEY:
# Tells to docker to start app after db (otherwise flask crashes)
depends_on:
- db
# Always restart on crash
restart: always

volumes:
qdj-data:</source>
=== Production <code>docker-compose.yaml</code> ===

We will adapt your <code>docker-compose.yaml</code> file in order to bind your site to the hostname :

<ol>
<li>First let's connect your <code>app</code> container to the global network. We won't bind the <code>db</code> container to the global network to protect it from intruders. [[File:https://cloud.binets.fr/s/QTgY55AapFDTyyW/preview|Network graph in endalcher]] We will add network configuration to the <code>docker-compose.yaml</code>:
<ul>
<li><p>to enable the network <code>web</code>, we add at the bottom of the file:</p>
<source lang="yaml">networks:
web:
external: true</source></li>
<li><p>to connect <code>app</code> to the network <code>web</code>, we add to the <code>app</code> configuration:</p>
<source lang="yaml">networks:
- web
- default</source></li></ul>
</li>
<li><p>Then we can add labels to tell <code>traefik</code> to match the hostname to a packet going to <code>app</code>:</p>
<source lang="yaml">labels:
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:qdj.binets.fr"
- "traefik.port=5000"</source></li></ol>

This gives us the following <code>docker-compose.qdj.yaml</code>:

<source lang="yaml">version: '3.1'

services:

db:
image: postgres:alpine
restart: always
environment:
POSTGRES_USER: qdj
POSTGRES_PASSWORD: qdjpw
POSTGRES_DB: qdj
volumes:
- "qdj-data:/var/lib/postgresql/data"

app:
image: ${DOCKER_IMAGE}
environment:
FLASK_APP: qdj.py
FLASK_ENV: production
FLASK_DEBUG: 0
DATABASE_URI: "postgresql://qdj:qdjpw@db:5432/qdj"
SECRET_KEY:
depends_on:
- db
restart: always
networks:
- web
- default
labels:
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:qdj.binets.fr"
- "traefik.port=5000"

volumes:
qdj-data:

networks:
web:
external: true</source>
This file goes into the [https://gitlab.binets.fr/br/docker-services br/docker-services] repository, it will be used by the triggered pipeline to create your containers.

=== Triggering pipelines with Gitlab CI ===

In this pipeline, we will need to add 2 jobs:

* one to build the docker image using the <code>Dockerfile</code>
* one to trigger the [https://gitlab.binets.fr/br/docker-services br/docker-services] pipeline to create the containers.

To build the docker image, we will use the template do so:

<source lang="yaml"># Build docker image and upload to registry
docker:build:
stage: build
only:
- master
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
# For disabling TLS in docker-in-docker (not needed)
DOCKER_TLS_CERTDIR: ''
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG</source>
The second job is rather tricky. We will use <code>curl</code> to trigger the pipeline, using [https://docs.gitlab.com/ce/ci/triggers/README.html Gitlab Pipeline API]. This call is secured by a trigger token, which should be saved into your project variables as <code>$TRIGGER_TOKEN</code>. This is what the job looks like:

<source lang="yaml">docker:deploy:
stage: deploy
when: manual
script:
- apt-get update && apt-get install -y curl
- curl --request POST --form token=$TRIGGER_TOKEN --form ref=master --form variables[PROJECT]=qdj --form variables[DOCKER_IMAGE]=$IMAGE_TAG https://gitlab.binets.fr/api/v4/projects/560/trigger/pipeline</source>
Pay attention to this syntax because debugging this api call takes a lot of time...

If you want to add variables that will be used in your <code>docker-compose.yaml</code>, add other arguments to <code>curl</code> like <code>--form variables[WELCOME_MESSAGE]="Hello World!"</code>.

You can see an example of a CI using this in the [https://gitlab.binets.fr/br/qdj br/qdj] repo.

Note: for BR project, you can use the <code>trigger</code> syntax in the API call since you don't need autorisation.

== History ==

* In 2017, the BR16 set up a [https://kubernetes.io/ Kubernetes] cluster. They managed to set up a workflow to deploy seamlessly from gitlab on that cluster. However, the configuration was hard to maintain and the BR17 was not able to keep it going.
* In 2018, the BR17 (Oliver Facklam + Hadrien Renaud) set up a small docker service on a computer from the Salle Informatiques

= Developping a site for BR docker deployement =

Docker allows for most technologies to be abstracted into a container and thus most - if not all - sites can be deployed in docker. However, here is a bit of advice to make deployement less painful :

* Before using a particular external service (something that should run in a seperate container), check that a well supported docker image exists and with a BRman that there are no other constraints (for example, using a MinIO will go through a seperate dedicated server that already exists rather than a container).
* Use a postgres database to get access to an admin website for your server.

Translations:Tuto pour le déploiement des sites avec Docker/9/en

2026-08-05T12:40:20Z

A physical server called <code>endalcher</code> deploys and runs your container. It uses the following services to connect your service to the Interne:

Translations:Tuto pour le déploiement des sites avec Docker/8/en

2026-08-05T12:40:13Z

Daniela.cojocaru : Page créée avec « == Existing architecture == »

== Existing architecture ==

Translations:Tuto pour le déploiement des sites avec Docker/7/en

2026-08-05T12:40:07Z

Daniela.cojocaru : Page créée avec « * Basics of git (videos [https://git-scm.com/video/what-is-version-control here] or the beginning of [https://git-scm.com/book/en/v2 this awesome online book]) ; * Basics of containers (see a really good explanation [https://www.docker.com/resources/what-container here]) and of docker-compose (see the getting-started [https://docs.docker.com/compose/gettingstarted/ here]) ; * Basics of web (see an [https://developer.mozilla.org/en-US/docs/Learn/Getting_started_wi... »

* Basics of git (videos [https://git-scm.com/video/what-is-version-control here] or the beginning of [https://git-scm.com/book/en/v2 this awesome online book]) ;
* Basics of containers (see a really good explanation [https://www.docker.com/resources/what-container here]) and of docker-compose (see the getting-started [https://docs.docker.com/compose/gettingstarted/ here]) ;
* Basics of web (see an [https://developer.mozilla.org/en-US/docs/Learn/Getting_started_with_the_web/How_the_Web_works introduction] on MDN) ;
* Basics of gitlab-ci (reading the [https://docs.gitlab.com/ee/ci/ getting-started] is recommended) ;

Translations:Tuto pour le déploiement des sites avec Docker/6/en

2026-08-05T12:40:01Z

Daniela.cojocaru : Page créée avec « == Requirements == »

== Requirements ==

Translations:Tuto pour le déploiement des sites avec Docker/5/en

2026-08-05T12:39:56Z

Daniela.cojocaru : Page créée avec « This tutorial will walk you through : * How to convert your website to a Docker service * How to build it automatically on Gitlab-CI * How to deploy it automatically on our servers »

This tutorial will walk you through :
* How to convert your website to a Docker service
* How to build it automatically on Gitlab-CI
* How to deploy it automatically on our servers

Tuto pour le déploiement des sites avec Docker/en

2026-08-05T12:39:50Z

Daniela.cojocaru : Page créée avec « == Overview == »

At the end of this tutorial you will be able to deploy your website (or service) on the servers of the BR! This allows you to benefit from a free, high-performance and robust infrastructure!

Note: this tutorial may be a bit tricky, so please don’t hesitate to get in touch with a BRman to get help.

<span id="Comment_déployer_des_conteneurs_Docker_sur_l'infrastructure_du_BR"></span>
= How to deploy Docker containers on the infrastructure of the BR =

== Overview ==

<div lang="fr" dir="ltr" class="mw-content-ltr">
This tutorial will walk you through :
* How to convert your website to a Docker service
* How to build it automatically on Gitlab-CI
* How to deploy it automatically on our servers
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
== Requirements ==
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
* Basics of git (videos [https://git-scm.com/video/what-is-version-control here] or the beginning of [https://git-scm.com/book/en/v2 this awesome online book]) ;
* Basics of containers (see a really good explanation [https://www.docker.com/resources/what-container here]) and of docker-compose (see the getting-started [https://docs.docker.com/compose/gettingstarted/ here]) ;
* Basics of web (see an [https://developer.mozilla.org/en-US/docs/Learn/Getting_started_with_the_web/How_the_Web_works introduction] on MDN) ;
* Basics of gitlab-ci (reading the [https://docs.gitlab.com/ee/ci/ getting-started] is recommended) ;
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
== Existing architecture ==
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
A physical server called <code>endalcher</code> deploys and runs your container. It uses the following services to connect your service to the Internet:
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
* [https://docs.docker.com/compose/ docker-compose] to deploy the correct environment for your containers ;
* [https://docs.traefik.io/v1.7/ traefik] as a reverse proxy to serve your site behind your endpoint, it is configured [https://gitlab.binets.fr/br/docker-default-services here] ;
* nginx to serve your site to the outside world (as all the binets sites).
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
== How to convert your website to a Docker service ==
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
The exact procedure will be dependant on your project. An example can be found here : [https://gitlab.binets.fr/br/qdj/-/blob/master/deployment/Dockerfile?ref_type=heads qdj-Dockerfile]
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
A ''Docker container'' is an isolated machine on which you can run your website. In this step, we will help you convert you app to be Docker-ready. This basically means installing everything your app needs inside a linux computer. You'll need to install ''Docker'' on your computer first [https://docs.docker.com/desktop/install/windows-install/ windows-installer].
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
We assume your project is hosted on the [https://gitlab.binets.fr BR's gitlab instance]. Create a <code>deployment</code> directory at the root of your repository and create a file <code>Dockerfile</code> (with no extension) and a file <code>docker-compose.yaml</code> in it.
</div>

* Dockerfile
<source lang="yaml">
FROM hello-world
</source>

* docker-compose.yaml
<source lang="yaml">
# this is a docker-compose meant for local testing of the deployment image.
# for the real deployment, go to the docker-services BR gitlab project

version: "3"
services:
app:
build:
context: ..
dockerfile: deployment/Dockerfile
# ports:
# - "8000:8000"
</source>

<div lang="fr" dir="ltr" class="mw-content-ltr">
Then open a terminal in this directory and type <code>docker compose up --build</code>. If everything went well, you see a nice message from Docker telling you everything is working !
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
Now, you need to make ''your'' app work in the docker container. For this, you need:
</div>

<div lang="fr" dir="ltr" class="mw-content-ltr">
* To update the Dockerfile to install everything you need. The following works for a basic (Django) python app :
</div>
<source>
FROM python:3

# copies all the code inside the container
COPY . /my_super_project

WORKDIR /my_super_project
RUN pip install --no-cache-dir -r requirements.txt
CMD python3 manage.py runserver
</source>

* To update the docker-compose file to expose the port you need (uncomment the corresponding line in the dockerfile).

=== How to handle persistant data ===

If you app uses an external database or need to not lose some files accross resets, you should use ''docker volumes'' with or without a ''postgres'' image. The [https://gitlab.binets.fr/br/docker-services/-/blob/master/docker-compose.site-jtx.yml?ref_type=heads jtx-docker-compose] might help you understand what you need.

=== How to handle secrets ===

Often your app has some secrets in a file (such as ''.env'') that is not in Git. DO NOT put it in git (or all your secrets will be stolen !). Later we are going to see how to securely make them available for the automatic gitlab build.

== Automatic build ==

We will you ''gitlab continuous integration'' to build your docker image directly on the BR's servers. Write the following into a file name <code>.gitlab-ci.yml</code> at the root of your repository :

<source lang="yaml"># Build docker image and upload to registry
variables:
IMAGE_TAG: $CI_REGISTRY_IMAGE:$CI_PIPELINE_IID
PROJECT: mySuperProject

docker:build:
stage: build
only: # put here the git branches you want the job to run on :
- main
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
DOCKER_TLS_CERTDIR: '' # disables TLS in docker-in-docker (not needed)
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG
</source>

As you commit this file to Gitlab, you should see a new job appear (or look under Build/jobs). Your image should build correctly (if not, it means something is not available to gitlab that is when you build on your computer. Read the job logs and try to fix it !)

=== Checking the image ===

This step is optional, but it is the easiest way to debug your image ! You can run it locally like so :

<source lang=bash>
docker login registry.binets.fr
docker run --rm registry.binets.fr/<nom.prenom>/<my-gitlab-repo>:<image>
</source>

Where <code>image</code> is the number of the image (available in <code>Gitlab -> Deploy -> Container registry</code>) and <code><nom.prenom>/<my-gitlab-repo></code> is the same as in your project Gitlab URL.

Typically, your app won't start because you forgot a secret file (see below how to manage that !).

== Automatic deployment ==

We will now add a second CI job to your repository to deploy your image. It will trigger ''another'' CI pipeline of [https://gitlab.binets.fr/br/docker-services br/docker-services]. This pipeline has the rights to deploy on <code>endalcher</code>, and does so using a <code>docker-compose.yaml</code> file. To trigger it, add the following to your <code>.gitlab-ci.yml</code>

<source lang=yaml>
docker:deploy:
stage: deploy
only:
- stable
image: debian:latest
when: manual
script:
- apt-get update && apt-get install -y curl
- curl --fail-with-body --request POST --form token=$TRIGGER_TOKEN --form ref=master --form variables[PROJECT]=$PROJECT --form variables[DOCKER_IMAGE]=$IMAGE_TAG https://gitlab.binets.fr/api/v4/projects/560/trigger/pipeline
</source>

Make sure the variable <code>PROJECT</code> in <code>.gitlab-ci.yml</code> is correct : our pipeline will deploy the file named <code>docker-compose.${PROJECT}.yaml</code>.

In order to create the correct <code>docker-compose.${PROJECT}.yaml</code> file, you will need to create a Merge Request on [https://gitlab.binets.fr/br/docker-services br/docker-services], or send a <code>docker-compose.yaml</code> file to a BRman. The [https://gitlab.binets.fr/br/docker-services br/docker-services] is full of examples and a basic one is explained below :

=== Extra parameters and secrets ===

''Be aware that any secret passed this way is still visible to the BR and everyone that has maintainer access to you repository ! If you need help setting up, don't hesitate to ask for help from the BR !''

You can also pass any parameter needed in the compose file by adding arguments to the cURL call like so : <code>--form variables[MY_SUPER_VARIABLE]="elle vaut 42!"</code>

If you want to pass secret environnements variables, store them in <code>Gitlab -> Settings -> CI-CD -> Variables</code> and make sure they are "protected" and "masked". Pass them like so <code>--form variables[MY_PASSWORD]=$PASSWORD_STORED_IN_GITLAB</code>.

=== Secret files ===

''Be aware that any secret passed this way too is visible to the BR and everyone that has ''ANY'' access to you repository (because they can get the docker image) ! So only do this for a private registry or make sure your setting <code>Settings -> General -> Visibility, project features, permissions</code> only allows for registry access for members''

Another way to store secrets in your Gitlab repo is <code>Gitlab -> Settings -> CI-CD -> Secure-files</code>. You can upload any (small) secret file here and it will not be exposed ! You can downlod it at buildtime like so :

<source lang=yaml>
# Build docker image and upload to registry
docker:build:
stage: build
only:
- main
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
# For disabling TLS in docker-in-docker (not needed)
DOCKER_TLS_CERTDIR: ""
# !!! where to download our secure .env file
SECURE_FILES_DOWNLOAD_PATH: "."
script:
# !!! download secure .env file
- apk add --no-cache curl bash
- curl --silent "https://gitlab.com/gitlab-org/incubation-engineering/mobile-devops/download-secure-files/-/raw/main/installer" | bash
# build docker image
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG
- echo "=> pushed $IMAGE_TAG"
</source>

=== Private repository ===

Keeping your repository private can be beneficial for security or privacy. But it require an extra step for the BR to access the docker image. We wille pass a [https://docs.gitlab.com/ee/user/project/deploy_tokens/#gitlab-deploy-token CI deploy token] as cURL parameter.

* Go to your <code>Settings -> Repository -> Deploy token</code> and create a token name exactly <code>gitlab-deploy-token</code>

* Add the following parameters to the cURL call in your CI deploy job : <code> --form variables[OPTIONAL_PRIVATE_CI_REGISTRY]=$CI_REGISTRY --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_USER]=$CI_DEPLOY_USER --form variables[OPTIONAL_PRIVATE_CI_REGISTRY_PASSWORD]=$CI_DEPLOY_PASSWORD </code>

== Example ==

You want to deploy the QDJ site with docker, and bind it to the server name <code>qdj.binets.fr</code>. Your site is running on flask and uses a postgresql database.

=== Pre-existant configuration ===

You have a little <code>Dockerfile</code>:

<pre># Base image: python3
FROM python:3
WORKDIR /usr/src/app

# Install dependacies
COPY requirements.txt ./
RUN pip install --no-cache-dir -r requirements.txt

# Copy application files
COPY . .

EXPOSE 5000/tcp

# the command runs the migrations and then launches gunicorn to serve the app
CMD python -m flask db upgrade && gunicorn -b :5000 qdj:app</pre>
You have the following <code>docker-compose.yaml</code>:

<source lang="yaml">version: '3.1'

services:
db:
# Use a small postgres image, as we don't need anything on this container
image: postgres:alpine
environment:
POSTGRES_USER: qdj
POSTGRES_PASSWORD: somepassword
POSTGRES_DB: qdj
# store the data on a persistent file
volumes:
- "qdj-data:/var/lib/postgresql/data"
restart: always

app:
# Use the image from Dockerfile
image: ${DOCKER_IMAGE}
environment:
FLASK_APP: qdj.py
FLASK_ENV: production
FLASK_DEBUG: 0
DATABASE_URI: "postgresql://qdj:somepassword@db:5432/qdj"
SECRET_KEY:
# Tells to docker to start app after db (otherwise flask crashes)
depends_on:
- db
# Always restart on crash
restart: always

volumes:
qdj-data:</source>
=== Production <code>docker-compose.yaml</code> ===

We will adapt your <code>docker-compose.yaml</code> file in order to bind your site to the hostname :

<ol>
<li>First let's connect your <code>app</code> container to the global network. We won't bind the <code>db</code> container to the global network to protect it from intruders. [[File:https://cloud.binets.fr/s/QTgY55AapFDTyyW/preview|Network graph in endalcher]] We will add network configuration to the <code>docker-compose.yaml</code>:
<ul>
<li><p>to enable the network <code>web</code>, we add at the bottom of the file:</p>
<source lang="yaml">networks:
web:
external: true</source></li>
<li><p>to connect <code>app</code> to the network <code>web</code>, we add to the <code>app</code> configuration:</p>
<source lang="yaml">networks:
- web
- default</source></li></ul>
</li>
<li><p>Then we can add labels to tell <code>traefik</code> to match the hostname to a packet going to <code>app</code>:</p>
<source lang="yaml">labels:
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:qdj.binets.fr"
- "traefik.port=5000"</source></li></ol>

This gives us the following <code>docker-compose.qdj.yaml</code>:

<source lang="yaml">version: '3.1'

services:

db:
image: postgres:alpine
restart: always
environment:
POSTGRES_USER: qdj
POSTGRES_PASSWORD: qdjpw
POSTGRES_DB: qdj
volumes:
- "qdj-data:/var/lib/postgresql/data"

app:
image: ${DOCKER_IMAGE}
environment:
FLASK_APP: qdj.py
FLASK_ENV: production
FLASK_DEBUG: 0
DATABASE_URI: "postgresql://qdj:qdjpw@db:5432/qdj"
SECRET_KEY:
depends_on:
- db
restart: always
networks:
- web
- default
labels:
- "traefik.docker.network=web"
- "traefik.frontend.rule=Host:qdj.binets.fr"
- "traefik.port=5000"

volumes:
qdj-data:

networks:
web:
external: true</source>
This file goes into the [https://gitlab.binets.fr/br/docker-services br/docker-services] repository, it will be used by the triggered pipeline to create your containers.

=== Triggering pipelines with Gitlab CI ===

In this pipeline, we will need to add 2 jobs:

* one to build the docker image using the <code>Dockerfile</code>
* one to trigger the [https://gitlab.binets.fr/br/docker-services br/docker-services] pipeline to create the containers.

To build the docker image, we will use the template do so:

<source lang="yaml"># Build docker image and upload to registry
docker:build:
stage: build
only:
- master
- stable
image: docker:stable
services:
- docker:dind
variables:
DOCKER_HOST: tcp://docker:2375/
DOCKER_DRIVER: overlay2
# For disabling TLS in docker-in-docker (not needed)
DOCKER_TLS_CERTDIR: ''
script:
- docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
- docker build --pull --build-arg version=$CI_PIPELINE_IID -t $IMAGE_TAG -f deployment/Dockerfile .
- docker push $IMAGE_TAG</source>
The second job is rather tricky. We will use <code>curl</code> to trigger the pipeline, using [https://docs.gitlab.com/ce/ci/triggers/README.html Gitlab Pipeline API]. This call is secured by a trigger token, which should be saved into your project variables as <code>$TRIGGER_TOKEN</code>. This is what the job looks like:

<source lang="yaml">docker:deploy:
stage: deploy
when: manual
script:
- apt-get update && apt-get install -y curl
- curl --request POST --form token=$TRIGGER_TOKEN --form ref=master --form variables[PROJECT]=qdj --form variables[DOCKER_IMAGE]=$IMAGE_TAG https://gitlab.binets.fr/api/v4/projects/560/trigger/pipeline</source>
Pay attention to this syntax because debugging this api call takes a lot of time...

If you want to add variables that will be used in your <code>docker-compose.yaml</code>, add other arguments to <code>curl</code> like <code>--form variables[WELCOME_MESSAGE]="Hello World!"</code>.

You can see an example of a CI using this in the [https://gitlab.binets.fr/br/qdj br/qdj] repo.

Note: for BR project, you can use the <code>trigger</code> syntax in the API call since you don't need autorisation.

== History ==

* In 2017, the BR16 set up a [https://kubernetes.io/ Kubernetes] cluster. They managed to set up a workflow to deploy seamlessly from gitlab on that cluster. However, the configuration was hard to maintain and the BR17 was not able to keep it going.
* In 2018, the BR17 (Oliver Facklam + Hadrien Renaud) set up a small docker service on a computer from the Salle Informatiques

= Developping a site for BR docker deployement =

Docker allows for most technologies to be abstracted into a container and thus most - if not all - sites can be deployed in docker. However, here is a bit of advice to make deployement less painful :

* Before using a particular external service (something that should run in a seperate container), check that a well supported docker image exists and with a BRman that there are no other constraints (for example, using a MinIO will go through a seperate dedicated server that already exists rather than a container).
* Use a postgres database to get access to an admin website for your server.

Translations:Tuto pour le déploiement des sites avec Docker/4/en

2026-08-05T12:39:48Z

Daniela.cojocaru : Page créée avec « == Overview == »

== Overview ==