BlogsGitLabCI/CD Minute Quotas and Abuse Prevention

CI/CD Minute Quotas and Abuse Prevention

CI/CD Minute Quotas and Abuse Prevention

6
posts
2017–2021

GitLab.com is extending CI/CD minute usage quotas to public projects not part of GitLab open source programs to prevent abuse, such as cryptocurrency mining, which negatively impacts performance and availability of shared runners. This change aims to ensure reliable service for all users by limiting excessive consumption of free pipeline minutes. Users will be notified upon reaching their quota and can upgrade their plan or purchase additional minutes. Self-managed users and members of GitLab's open source programs are exempt. Previously, unlimited CI minutes were offered for free.

2021

Changes to GitLab.com public project CI/CD minute quotas

11/11/2021

Introduced CI/CD minute quotas for public projects on GitLab.com to mitigate abuse from cryptocurrency mining. This change impacts users not part of open source programs, providing them with a defined limit on shared runner minutes. Users will receive notifications upon reaching their quota and have options to upgrade or purchase additional minutes. Self-managed users and open source program members are exempt.

How to prevent crypto mining abuse on GitLab.com SaaS

5/17/2021

This post details the implementation of CI/CD minute quotas for public projects on GitLab.com to prevent abuse, specifically cryptocurrency mining. It outlines the gradual rollout strategy, starting with new free users and potentially extending to existing accounts. The post also lists several technical improvements already implemented to mitigate pipeline abuse, such as failing jobs when quotas are exceeded, restricting namespace creation via API, and ensuring pipelines don't run for blocked users or deleted accounts. It also mentions the inclusion of public projects in quota calculations and the ongoing effort to harden the pipeline system against abuse.

2020

Automation check-in and rate limit changes on GitLab.com

12/17/2020

Introduced new rate limits on GitLab.com activity effective January 18, 2021: 500 requests/min for unauthenticated traffic per IP, 2,000 requests/min for authenticated API traffic per user, 1,000 requests/min for other authenticated HTTP traffic per user, and 2,000 requests/min for all traffic per IP when not otherwise covered. Documented these limits and advised users to handle 429 responses with the `Retry-After` header. The goal is to improve stability and availability.

Upcoming changes to CI/CD minutes for free tier users on GitLab.com

9/1/2020

This post announces a reduction in CI/CD minutes for the GitLab.com Free tier to 400 minutes per top-level group per month, effective October 1, 2020. It explains the rationale behind the change due to increased costs from significant user growth and outlines options for users to manage their usage, including bringing their own runners, purchasing additional minutes, or upgrading to a paid tier. It also clarifies that minute limits remain unchanged for Open Source, Education, and Startups programs.

Changes to CI pipeline minutes for new free users

3/18/2020

Introduced a change to CI pipeline minutes for new free users, setting a limit of 2000 minutes per group per month. This change is driven by efficiency goals and analysis of free user CI minute consumption. The post also outlines options for users who need more minutes (purchasing additional minutes or using self-hosted runners) and mentions upcoming CI improvements like Windows/MacOS runners, dynamic child pipeline creation, autoscaling on AWS Fargate, and pipeline failure notifications.

2017

Introducing paid subscriptions on GitLab.com

4/11/2017

Introduced paid subscriptions to GitLab.com, including a limit of 2000 private CI minutes per group on shared runners starting May 1st. This change aims to ensure the sustainability of the free tier while offering additional features and support through new paid plans (Bronze, Silver, Gold). Specific runners are not affected by this limit.