andrew.dunn.dev

gitlab-simulation

~3 min
gitlabself-managedsimulationllmair-gapmcp
Source Public Sector compliance matrix

gitlab-simulation is a Claude Code plugin, published under the GitLab.com Public Sector group, that provisions ephemeral self-managed GitLab instances on Google Compute Engine for LLM-mediated work.

I built gitlab-simulation to do LLM-mediated work against real GitLab instances, the way an LLM found a year-old kernel deadlock in a single session: hear a signal, build a reproducer, and land the change into the product with as little friction as possible. That takes several simulation streams running at once, and I don’t want my laptop carrying them, so each simulation is a disposable cloud VM rather than a local checkout. The self-managed cases that never surface on SaaS, airgapped networks, Duo Agent Platform flow execution, Ultimate and other license-gated behavior, two-site Geo failover, are exactly the ones a bench like that is for. It is the environment half of a pair: its sibling gitlab-contribution, the workflow half, routes GDK-shaped needs here.

ssh :4252inside the VMLAPTOPClaude Codecontrol plane onlyONE COMMANDjust upone recipe, one VMEPHEMERAL GCE VMself-managed GitLabcaproni, omnibus, devAUTO-DESTROY4 hours8h for a Geo pairIN-VMbrowser MCPplaywright-mcp :8931
One just command stands up a throwaway self-managed GitLab in Google Cloud, drives it through a browser inside that VM, and deletes it hours later.
EPHEMERAL GCEone of three bases, on just upauto-deletes after 4h, 8h for a Geo pairLAPTOPClaude CodeSKILL.md, control plane onlySINGLE DECLARATIVE ENTRYPOINTjustfile1 recipe : 1 subcommandENGINE, SHELLS OUT TO GCLOUDsimulation.shcreates, configures, destroysLAPTOP MCP SERVERmultiplexer.pypolls gcloud list every ~10sssh :4252 per sim, by spec labelBASEcapronik3s + Helm + gitlab-dev-stack, CNPG;airgap + DAP only; AIGW mocked or realBASEomnibussingle-VM package install; fastest pathto an instance, and Geo pairs two of themBASEdevgitlab-org/gitlab source + build-imagescontainer, Postgres + Redis, no GitalyIN-VMbrowser MCPplaywright-mcp, systemd user unitport 8931, headless Chromium in the VMDNS, ingress, certs as a real userARCHETYPEgeotwo omnibus VMs, primary + secondaryregistry backed by the metadata databaseper-pair state files, clusters coexist
The laptop only issues commands: simulation.sh drives gcloud to build one of three GitLab bases on a throwaway VM, and a browser inside that VM does the verifying.

The laptop stays control plane only: a just recipe routes through justfile into simulation.sh, which shells out to gcloud to create, configure, and destroy the VM. up stands one of three bases, caproni, omnibus, or dev: caproni alone reaches airgap and Duo Agent Platform work, omnibus is fastest to a working instance and the base Geo clusters in pairs, and dev runs GitLab source against a build container. Airgap is enforced at the GCP firewall, not by the cluster’s own claims, and verified with a negative control: an external pull that must fail beside an internal one that must succeed. multiplexer.py bridges the laptop to a playwright-mcp server inside the VM for UI and OAuth verification, so the browser sees real DNS, ingress, and certificates rather than a mock. Every VM auto-deletes after four hours, eight for a Geo pair, as a crash safety net on top of an explicit just down teardown that stays mandatory regardless.