Configure flow execution

{{< history >}}

• Introduced in GitLab 18.3.

{{< /history >}}

Flows use agents to execute tasks.

• Flows executed from the GitLab UI use CI/CD.
• Flows executed in an IDE run locally.

You can configure the environment where flows use CI/CD to execute. You can also choose to use your own runners, and specify variables in your jobs.

Flow security

When flows execute in GitLab CI/CD:

• They use a composite identity to limit access.
• They create an ephemeral workload pipieline, which is removed when the flow is complete.
• The tools at their disposal are specific to the purpose of the flow. These tools can include the creation of merge requests or the running of local shell commands in their execution environment.

By default, flows have network access to the GitLab instance only. For more information about network access rules, see how to configure a network policy. This separate environment protects from unintended consequences of running shell commands.

To prevent flows from running autonomously in the GitLab UI, you can turn off flow execution.

Executor architecture

When a flow runs in CI/CD, the runner:

1. Downloads the @gitlab/duo-cli package from the npm registry.
2. Runs the GitLab Duo CLI, which uses WebSocket to connect to the GitLab Duo Workflow Service.
3. Executes tools (file operations, Git commands) as directed by the AI model.

The executor version is managed by GitLab and updated as part of regular releases.

[!note] The @gitlab/duo-cli npm package is labeled "Experimental" for standalone CLI usage. When used within flows, the relevant capabilities are covered by the same support level as flows.

Configure CI/CD execution

You can customize how flows are executed in CI/CD by creating an agent configuration file in your project.

[!note] You cannot use predefined CI/CD variables in this scenario. See the list of available variables.

Create the configuration file

1. In your project's repository, create a .gitlab/duo/ folder if it doesn't exist.
2. In the folder, create a configuration file named agent-config.yml.
3. Add your desired configuration options (see sections below).
4. Commit and push the file to your default branch.

The configuration is applied when flows run in CI/CD for your project.

Change the default Docker image

By default, all flows executed with CI/CD use a standard Docker image provided by GitLab. This Docker image automatically includes network protection by using Anthropic Sandbox Runtime (srt). You can change the Docker image and specify your own instead. Your own image can be useful for complex projects that require specific dependencies or tools. If you do this, and you still want to use network protection, make sure to add srt to your Docker image with your preferred version:

# Install srt sandboxing with cache clearing and verification
ARG SANDBOX_RUNTIME_VERSION=0.0.20
RUN npm cache clean --force && \
    npm install -g @anthropic-ai/sandbox-runtime@${SANDBOX_RUNTIME_VERSION} && \
    test -s "$(npm root -g)/@anthropic-ai/sandbox-runtime/package.json" && \
    srt --version

For more information about SRT and how to install it on a custom image, see remote execution environment sandbox.

To change the default Docker image, add the following to your agent-config.yml file:

image: YOUR_DOCKER_IMAGE

For example:

image: python:3.11-slim

Or for a Node.js project:

image: node:20-alpine

Custom image requirements

If you use a custom Docker image, ensure that the following commands are available for the agent to function correctly:

• git
• npm with a Node.js version compatible with @gitlab/duo-cli. For more information, see GitLab Duo CLI prerequisites.

Most base images include these commands by default. However, minimal images (like alpine variants) might require you to install them explicitly. If needed, you can install missing commands in the setup script configuration.

[!note] In GitLab 18.9 and earlier, there is a known issue (587996) where flows might fail with newer versions of git in custom images. This issue is resolved in @gitlab/duo-cli version 8.71.0.

If you are on @gitlab/duo-cli version 8.71.0 or earlier, to avoid flows failing with newer Git versions, you can do either following:

• Use Git version 2.43.7 or earlier in your custom image
• Use @gitlab/duo-cli version 8.71.0.

Additionally, depending on the tool calls made by agents during flow execution, other common utilities may be required.

For example, if you use an Alpine-based image:

image: python:3.11-alpine
setup_script:
  - apk add --update git nodejs npm

[!note] When you use a custom Docker image, the environment sandbox is only applied when Anthropic Sandbox Runtime (SRT) is included in your custom image. If SRT is not included, your flow can access any domain reachable from the runner and the full filesystem. If you require network isolation with custom images, install SRT on your image and configure a network policy, or configure network-level controls on your runner (for example, firewall rules or network policies). If you include the @gitlab-org/duo-cli npm package in your custom image, the flow startup skips the npm download step and reduces job startup time by approximately 15-20 seconds.

Configure setup scripts

You can define setup scripts that run before your flow executes. This is useful for installing dependencies, configuring environments, or performing any necessary initialization.

To add setup scripts, add the following to your agent-config.yml file:

setup_script:
  - apt-get update && apt-get install -y curl
  - pip install -r requirements.txt
  - echo "Setup complete"

These commands:

• Run before the main workflow commands.
• Execute in the order specified.
• Can be a single command or an array of commands.

[!note] The user context for setup_script depends on the Docker image. The default GitLab image runs as root. Custom images run as the user defined in the image's USER directive. If your setup_script requires root access (for example, to install system packages), ensure your custom image is configured accordingly.

Configure caching

You can configure caching to speed up subsequent flow runs by preserving files and directories between executions. Caching can be useful for dependency folders like node_modules or Python virtual environments.

Basic cache configuration

To cache specific paths, add the following to your agent-config.yml file:

cache:
  paths:
    - node_modules/
    - .npm/

Cache with keys

You can use cache keys to create different caches for different scenarios. Cache keys help ensure that the cache is based on your project's state.

Use a string key

cache:
  key: my-project-cache
  paths:
    - vendor/
    - .bundle/

Use file-based cache keys

Create dynamic cache keys based on file contents (like lock files). When these files change, a new cache is created. This generates a SHA checksum of the specified files:

cache:
  key:
    files:
      - package-lock.json
      - yarn.lock
  paths:
    - node_modules/

Use a prefix with file-based keys

Combine a prefix with the SHA computed for the cache key files:

cache:
  key:
    files:
      - package-lock.json
    prefix: $CI_JOB_NAME
  paths:
    - node_modules/
    - .npm/

In this example, if the job name is test and the SHA checksum is abc123, the cache key becomes test-abc123.

Cache limitations

• You can specify up to two files for cache key generation. If more files are specified, only the first two are used.
• The cache paths field is required. A cache configuration without paths has no effect.
• Cache keys support CI/CD variables in the prefix field.

Complete configuration example

Here's an example agent-config.yml file that uses all available options:

# Custom Docker image
image: python:3.11

# Setup script to run before the flow
setup_script:
  - apt-get update && apt-get install -y build-essential
  - pip install --upgrade pip
  - pip install -r requirements.txt

# Cache configuration
cache:
  key:
    files:
      - requirements.txt
      - Pipfile.lock
    prefix: python-deps
  paths:
    - .cache/pip
    - venv/

# Network configuration
network_policy:
  include_recommended_allowed: true
  allow_all_unix_sockets: true
  allowed_domains:
    - my-own-site.com
  denied_domains:
    - malicious.com

This configuration:

• Uses Python 3.11 as the base image.
• Installs build tools and Python dependencies before running the flow.
• Caches pip and virtual environment directories.
• Creates a new cache when requirements.txt or Pipfile.lock changes, with a prefix of python-deps.

Configure runners

Flows that use CI/CD are executed on runners. These runners must:

• Use an executor that supports Docker images. For example, docker, docker-autoscaler, kubernetes, or others. The shell executor is not supported.
• Have the gitlab--duo tag, so the runner knows to pick up the correct jobs.
• Be instance runners or assigned to the top-level group. Flows cannot use runners configured for a subgroup or project. On GitLab Self-Managed this restriction can be disabled by disabling the duo_runner_restrictions feature flag.

In addition, runners on GitLab Self-Managed:

• Must allow network traffic to the GitLab Duo Agent Platform Service configured for the GitLab instance.
  • The GitLab Duo Agent Platform Service ships with the AI Gateway. If you self-host the AI Gateway and don't set a local URL for the Agent Platform, agentic features route traffic to duo-workflow-svc.runway.gitlab.net on port 443.
• Must be able to download the default image from registry.gitlab.com or be able to access the Docker image you specified.

For GitLab instances with self-signed certificates in the certificate chain, the GitLab Duo CLI requires additional configuration.

[!note] The runner's connection to the GitLab Duo Agent Platform Service is routed through the GitLab instance. Runners do not connect directly to duo-workflow-svc.runway.gitlab.net. The firewall requirement for duo-workflow-svc.runway.gitlab.net on port 443 applies to the GitLab instance, not the runner. Your runner network configuration must allow outbound HTTPS traffic to the GitLab instance.

On GitLab.com, flows can use:

• Hosted runners, which GitLab provides.

[!note] If your top-level group has IP address restrictions enabled, hosted runners cannot be used for flows. Hosted runners use dynamic IP addresses from cloud provider pools that cannot be added to your group's IP allowlist. Instead, configure your own group runner with the gitlab--duo tag at the top-level group level, and ensure its IP address is included in your group's allowlist.

Flows executed on runners can be secured with runtime sandboxing offering network and file system isolation. To benefit from sandboxing you must:

1. Enable privileged mode by setting privileged = true in your runner configuration.
2. Use either:
   • The default Docker base image for GitLab Duo Agent Platform
   • A custom image with SRT installed

Runner privileged mode

Privileged mode is required when you want to use the environment sandbox protection. This applies when you use either the default GitLab-provided image or a custom image with SRT installed. If you use a custom Docker image without SRT, privileged mode is not required because the sandbox cannot be applied.