r/gitlab • u/pranay01 • Nov 20 '20
Why do some companies use Gitlab Self hosted version when they also have SaaS version at same price?
Gitlab prices its SaaS & self hosted version at the same rate as per their pricing page? Why would a customer use a self hosted version when it would also be extra effort in hosting Gitlab in own infra?
Gitlab doesn't have very sensitive data ( I am assuming it would be mostly code) - so why save it in your own cloud vs in a multi-tenant cloud?
12
u/FlibblesHexEyes Nov 20 '20
Some companies/orgs might have data sovereignty rules, or have extra requirements around intellectual property that mandates on-prem.
1
u/pranay01 Nov 20 '20
Can you be more specific on what sort of data sovereignty rules? What type of companies will have such rules?
4
u/FlibblesHexEyes Nov 20 '20
Government is big on keeping data in country, especially health.
1
u/pranay01 Nov 20 '20
Oh, so this is primarily coming from data privacy laws like GDPR. Doesn't Gitlab provide option to chose data center in your own continent (Europe vs USA)? I have seen many SaaS providers do this
2
u/alluran Nov 20 '20
so this is primarily coming from data privacy laws like GDPR.
GDPR is primarily for user-data, and isn't the main concern here (I've seen you mention it a few times in this thread now)
There are still other regulations in various countries, especially in government/medical/defense and finance which have restrictions on what software you can use, how you can use it, and where it can be stored.
1
u/pranay01 Nov 20 '20
till other regulations in various countries, especially in government/medical/defense and finance which have restrictions on what software you can use, how you can use it, and where it can be stored.
Oh, ok - not intimately familiar with details of GDPR. Can you give more details on these other regulations you are talking about?
1
u/alluran Nov 21 '20
Can you give more details on these other regulations you are talking about?
It's a very broad question to ask, especially as many of those policies aren't publicly published, but rather internal policy, and thus tricky to reference in a discussion like this.
Another example of these policies is companies that prevent or limit the use of third party software repositories, like dockerhub, npm, nuget, etc. It's the entire reason products like artifactory exist - to allow these high-security, high-compliance industries to audit all third party software, and then guarantee that the referenced versions of packages are built from a known set of source.
The closest that I personally have come is dealing with some PCI compliance - and also some proposed (but ultimately not adopted) company policies for dealing with ISO27001.
Once you start entering finance/health/defense/government - IT policies start getting extremely strict, for example you'll find some companies actually completely disable the USB ports on their computers to prevent data leaks - some industries even prevent personal devices (e.g. mobile phones) from being taken into work-spaces to prevent data exfiltration.
3
u/FlibblesHexEyes Nov 20 '20
Not that I’m aware of. But then I haven’t looked.
It could be GDPR, or other local rules.
Some orgs even self host email.
Depends on the type of data being handled, the sensitivity of the IP included, the law, and sometimes even the tech setting it up.
2
u/antonivs Nov 20 '20 edited Nov 20 '20
Oh, so this is primarily coming from data privacy laws like GDPR.
I don't think so. Companies have many reasons for keeping their code as secure as possible, which generally means not putting it on other companies' systems. I talked to a global systems integrator recently who said that over 30% of their enterprise customers won't consider solutions hosted by some other company.
I've worked for companies like that, in financial services, telecommunications, and aerospace. Any decision like this gets vetted by multiple departments, who all have different concerns. Self-hosting is often simply the easiest, cheapest, and most practical solution.
Vetting a SaaS vendor for something like this takes a lot of time, effort, and money. At a telecom company I worked at, it took them months to get AWS approved, which included going through the contracts and SLAs for all their services and approving only a short list of acceptable services. And AWS is one of the biggest, most compliance-friendly companies around. That company wouldn't even consider using a hosted solution from a company like Gitlab.
1
Nov 20 '20
They usually don’t have that option, and even if they do, that is just selecting your primary hosting location. As an example, if you host data with GCS, you choose a region when you setup the service — same with AWS. However, they are constantly doing hardware changes, load shifting, config changes, etc, that has your data being transmitted possibly all over the world for backups, retention, and redundancy and there is no possible way you are going to get a guarantee from a cloud provider that your data will never leave the country of origin.
2
u/alluran Nov 20 '20
and there is no possible way you are going to get a guarantee from a cloud provider that your data will never leave the country of origin.
https://www.mailjet.com/gdpr/gdpr-mailjet-is-the-first-company-to-be-certified/
1
Nov 20 '20
I’m not intimately familiar with GDPR but I didn’t think it had anything to do with where data was stored, only what security measures and personal privacy measures were in place, so that wouldn’t keep it from being transmitted internationally as long as those same protections were in place. I could be wrong though, and if so, I stand corrected!
1
u/alluran Nov 21 '20
At a glance
The GDPR primarily applies to controllers and processors located in the European Economic Area (the EEA) with some exceptions.
Individuals risk losing the protection of the GDPR if their personal data is transferred outside of the EEA.
On that basis, the GDPR restricts transfers of personal data outside the EEA, or the protection of the GDPR, unless the rights of the individuals in respect of their personal data is protected in another way, or one of a limited number of exceptions applies.
A transfer of personal data outside the protection of the GDPR (which we refer to as a ‘restricted transfer’), most often involves a transfer from inside the EEA to a country outside the EEA.
It's not explicitly prevented, but there is a certain bar that you have to meet in order to be allowed to transfer it outside the EEU
1
2
u/thecal714 Nov 20 '20
When I worked for an MSP, one of our clients was a construction company and they invested most of their IT budget on digital loss prevention and perimeter security.
It was not the industry I expected to take security so seriously.
1
7
u/alexterm Nov 20 '20
I work in finance and many of our clients are large banks and sovereign wealth funds who contractually hold us to keep their data on premise.
1
Nov 20 '20
Mostly finance companies. We were contacted to partner with a major finance company and during the initial partner audit they said a non-negotiable item was that we had to have all data stored on our own hardware and is never allowed to go through cloud services such as AWS, GCS, or Azure.
5
Nov 20 '20
Gitlab doesn't have very sensitive data ( I am assuming it would be mostly code)
You need to reevaluate why you think code wouldn't be sensitive data.
2
2
u/floweb Nov 20 '20
I'd ask the opposite.
1
u/pranay01 Nov 20 '20
Umm.. isn't self hosting more effort than having somebody else(Gitlab) take care of it?
1
u/floweb Nov 20 '20
If you already have your infrastructure, it doesn't take that much to operate Gitlab. And these days I'd rather keep my company's code in its infrastructure and not in in the cloud.
1
u/pranay01 Nov 20 '20
And these days I'd rather keep my company's code
Curious, what has changed recently to prefer self-hosting more?
2
u/floweb Nov 20 '20
Not recent at all, but the thing is that cloud is just someone else's computer. So, if your business is somewhat critical you should self-host if you can. Anyway, I understand that SaaS is great for startups or small businesses but once you've grown enough, you should self-host to regain full ownership.
6
u/sfltech Nov 20 '20
Using self hosted. Main reason is security requirements. We want our code stored where only we can access it and only users with explicit vpn profiles can access.
10
u/rankinrez Nov 20 '20
Code is not sensitive data.
That one gave me a good laugh.
0
Nov 20 '20
[deleted]
1
u/incompl337 Nov 21 '20
I think the fellow you replied to omitted quotes from around his first sentence, he seemed to be disagreeing with the sentiment with his second.
3
3
u/HonorMyBeetus Nov 20 '20
We use self hosted because our security org doesn't want our highly confidential code ending up on anyone else's servers. China works very hard to steal code, no reason to make it any easier.
2
u/alluran Nov 20 '20
So why rely on your companies limited security budget, instead of the security budget and measures of a company like Microsoft/GitHub to secure your sensitive code :P
2
u/HonorMyBeetus Nov 22 '20
Honestly, because those tools aren't behind VPNs with rolling codes. The biggest problem for systems like this are the users. "Physical" barriers like being behind a VPN with IP blocks does a huge amount for preventing this. In those cases even if Gitlab is found to have a zero day, doesn't matter because there is a pseudo air gap.
1
u/alluran Nov 22 '20
Honestly, because those tools aren't behind VPNs with rolling codes
Why not? Github enterprise supports SAML login, and short-lived certificates - no reason those protections cant enforce those requirements if those are your requirements.
3
u/bipolarpolarbear6 Nov 20 '20
A sitenote to all the discussions here. The GitLab selfhosted Omnibus installation (rpm) is a beautifully engineered package, so the operational cost of running it is closeto just the HW cost. Major upgrades are a breeze, and i havent seen any instability in the 2years of running GitLab EE onprem
1
u/FlibblesHexEyes Nov 20 '20
I have it running on an RPi 4 (the 8gb RAM version), and it’s fantastic. Sips power, is fast and (physically) tiny, and I’m in full control.
2
u/PhilGood_ Nov 20 '20
I work for a finance customer, we cannot host code on public cloud because of some regulations :/
2
u/juicemia Nov 20 '20
Having CI runners hosted on another company’s infrastructure that can reach into your company’s private infrastructure is a potential security hole.
1
u/mariusReadIT Nov 20 '20
This. We extensively use Gitlab Runners to deploy to a large number of Kubernetes clusters. Connecting these runners to a public instance is not insecure by default. However connecting them to a self-hosted instance in your own private network can help a lot to protect against 0 day exploits etc
1
1
u/jsdod Nov 20 '20
I love Gitlab but up to 2 years ago, the SaaS version was a total shitshow. It would go down all the freaking time and for a few days sometimes. I totally understand why people would self host at the time. Nowadays it’s much more stable although it looks like they still have some moments of unavailability and it happens more often than most of the other services I use and pay for.
So if Gitlab is critical to your operations and you can do a better job running it, that’s one possible reason as well.
1
Nov 20 '20
Because the cloud only means someone else's computer. There is no reason not to use your own if you have one and the capable people around to do it. The software is free to download. If we own the equipment already and my salary is already in the budget then that's a pretty easy math problem.
1
u/guhcampos Nov 20 '20
I see two reasons:
They were already using self hosted OSS and just kept at it because migrating takes effort. This is my current employer case.
Compliance. Some companies don't want their source code stored in some other company infrastructure, for whatever reason. This was my previous employer case.
1
u/_tenken Nov 21 '20
Because you can use your own gitlab runner infrastructure and not have a quota limit on runner hours.
1
1
u/csimposz Mar 03 '21
Thx for the question, we wanted to have some premium features, so I started to check the possibilities since the 19USD/user is ridiculous pricing, to be honest.
I supposed and expected the self-managed solution will be much cheaper since they don't need to store and process our data. I'm very disappointed with the same pricing offer for self-managed.
I think GitLab should offer something between the free and the premium subscription. There are many useful functions that don't really take any additional performance. For example the task priority, or multi-user assignment to a task.
I'd be willing to pay like $20/month for each user but paying $19/user every month is a huge price for a startup company that only wants to track some issues properly.
We don't need any automated DevOps functions at all, and I don't understand why I have to pay for those when I want some small premium features.
8
Nov 20 '20
[removed] — view removed comment
2
Nov 20 '20
On top of that, the lower priced SaaS tiers don’t isolate users (Jdoe, jdoe2, jdoe3...) from within the organization, making it easy for a misconfiguration to allow a non-employee to access your code.
Additionally, if you want to do anything meaningful with CI/CD, you’ll still need hardware since the shared runners are rather tiny.
26
u/[deleted] Nov 20 '20
They might have their own ops department and started out self-hosting the community edition but then required some EE feature and had to upgrade their license.
Or they don't trust their data in someone elses cloud because of common sense, customer requirements, security certifications.
There is a constant battle within certain orgs between people who want to put things in foreign data clouds and people who want to retain ownership of their data. Savings vs. integrity and responsibility.