title: GitLab CI ssh registry login
body: <p>I have a GitLab project <code>gitlab.com/my-group/my-project</code> which has a CI pipeline that builds an image and pushes it to the project's GitLab registry <code>registry.gitlab.com/my-group/my-project:tag</code>. I want to deploy this image to Google Compute Engine, where I have a VM running docker. </p>
  
  <p>Easy enough to do it manually by ssh'ing into the VM, then <code>docker login registry.gitlab.com</code> and <code>docker run ... registry.gitlab.com/my-group/my-project:tag</code>. Except the <code>docker login</code> command is interactive, which is a no-go for CI. It can accept a username and password on the command line, but that hardly feels like the right thing to do, even if my login info is in a <a href="https://docs.gitlab.com/ce/ci/variables/" rel="nofollow noreferrer">secret variable</a> (storing my GitLab login credentials in a GitLab secret variable?...)</p>
  
  <p>This is the intended workflow on the Deploy stage of the pipeline:</p>
  
  <ol>
  <li>Either install the <code>gcloud</code> tool or use an image with it preinstalled</li>
  <li><code>gcloud compute ssh my-gce-vm-name --quiet --command \
  "docker login registry.gitlab.com &amp;&amp; docker run registry.gitlab.com/my-group/my-project:tag"</code></li>
  </ol>
  
  <p>Since the <code>gcloud</code> command would be running within the GitLab CI Runner, it <em>could</em> have access to secret variables, but is that really the best way to log in to the GitLab Registry over ssh <em>from GitLab</em>?</p>