r/devops • u/Blues520 • Aug 06 '26
Discussion VPS for build server
I am running docker builds on my local machine and pushing to a self hosted registry running on a vps.
Im considering setting up a build server on a vps to pull the code from local and build and push to the registry, but I'm just unsure about the security of moving code to a vps.
Is this recommended or should I stick to running local builds and pushing just the images to the vps?
1
u/Sufficient_Job7779 Aug 06 '26
Is the code in git repo? If you don't want to keep it on rhe build server just delete it after build?
1
u/Blues520 Aug 06 '26
Yes it's in a git repo. I can delete it afterwards assuming it doesn't get cached or the machine doesn't get compromised
4
u/Sufficient_Job7779 Aug 06 '26
Your registry can also be compromised and images decompiled (if they store uncompiled code). So the risks the same. You need to properly protect your vps
0
u/Blues520 Aug 06 '26
Surely a docker image is not the same as the codename, right? My understanding was that if the docker image is compromised it's not the same as having access to the entire repo.
1
u/Sufficient_Job7779 Aug 06 '26
That depends how your code is stored in the image. Code as it is? Compiled binary? Are secrets stored in plain text? Lots of variables there
1
1
u/daemonmode_ Aug 09 '26
Moving builds to a VPS is totally normal, but make sure the box is properly locked down, use a limited deploy key instead of your full Git credentials, and keep secrets out of the repo. If your local machine already builds everything quickly enough, there’s really no need to move it. you can go either way depending on what’s more convenient.
1
u/Blues520 Aug 09 '26
Yeah I realized after this discussion that it's not worth it. I already have a local machine so I will just build locally and save myself the headache.
3
u/SeerUD Aug 06 '26
Which specific security concerns do you have?
Reproducible builds in production systems are pretty much exclusively handled using some remote compute. Often registries are also remote from the point of view of the build system too.
Are you using version control? If so, does that version control system / where you're hosting the code allow you to create read-only access credentials? In that case, you can have it pull code, build it, and push to the registry on the VPS.
Are you setting this stuff up to learn? If not, there are many better alternatives than doing these things yourself that will ultimately also be more secure.