I currently build Docker images on my local machine and push them to a self-hosted registry running on a VPS. I'm considering moving the build process to another VPS so it can pull the source code from my Git repository, build the images, and push them to the registry. My main concern is whether putting the source code on a remote server creates unnecessary security or privacy risks, especially regarding access by the hosting provider. For a side project, is a remote VPS build server a reasonable approach, or is it safer to build locally and upload only the finished images?
2 Answers
Remote build systems are common, including for production workloads, so the basic approach is reasonable. Use a dedicated account or runner with read-only access to the repository and only the permissions needed to push images to the registry. Keep secrets out of the source tree and inject them only when required during the build. If the server is disposable, you can delete the checkout after each build, although that should not be treated as a complete security guarantee.
The VPS provider can generally access the underlying infrastructure, just as with any hosted service, so the decision depends on how sensitive the code is and what risks you are willing to accept. For an ordinary side project, a properly secured VPS is usually a practical option. Harden the machine, limit network access, use short-lived or narrowly scoped credentials, avoid storing secrets in build layers or logs, and consider an ephemeral build environment. If the code is highly confidential, keeping builds on hardware you control—or using a trusted hosted CI service with an appropriate security model—may be preferable.
That makes sense. My concern is mostly that the source code is being sent to a remote machine, but it isn’t especially sensitive. I’ll probably use a restricted checkout credential and clean up the workspace after each build.