title: GitLab CI and Distributed Build Confusion
body: <p>I'm relatively new to continuous integration servers. I've been using GitLab (v6.5) for a while to manage projects, but I'd like to begin using the GitLab CI to ensure tests pass and builds succeed.</p>
  
  <p>My testing setup consists of two virtual machines: one machine for GitLab and another machine for the GitLab CI (and runners). However, in production I only have a single machine, which is running GitLab. The GitLab team posted an <a href="https://about.gitlab.com/2013/06/20/integrating-gitlab-ci-with-gitlab/" rel="nofollow">interesting blog post</a> a while back that emphasized:</p>
  
  <blockquote>
    <p>If you are running tests on the CI server you are doing it wrong!</p>
  </blockquote>
  
  <p>It was a very informative post, but I didn't come away feeling like I understood this specific point. Does this mean one shouldn't run GitLab and GitLab CI on the same server? Does it mean one shouldn't run GitLab CI and GitLab CI runners on the same server? Or both-- Do I need three servers, one for each task?</p>
  
  <p>From the same post:</p>
  
  <blockquote>
    <p>Anybody who can push to a branch that is tested on a CI server can easily own that server.</p>
  </blockquote>
  
  <p>This implies to me that the runners are the security risk since they can run stuff contained in a commit. If that's the case, what's the typical implementation? Put GitLab and GitLab CI on the same machine, but the runners on a separate machine? Wouldn't it still suck if the runner machine was compromised? So people are okay losing their runner machine as long as their code machine is safe?</p>
  
  <p>I would really like to understand this a bit more-- definitely before I implement it in production. Is there any possible yet safe way to implement GitLab, GitLab CI, and GitLab CI runners all on the same machine?</p>