Drone

Drone#

Drone is a container-native CI engine. Pipelines are YAML in the repo; every step runs in its own container; the server hosts the UI and the queue; runners pull jobs and execute. Harness now owns it (“Harness Drone CI”); the OSS edition is still active. Lightweight alternative to Jenkins for teams that want self-hosted CI without the operational weight.

Architecture#

  • Server (drone/drone), the central process. Holds the pipeline queue, the UI, the user / repo registry, the webhook receiver. Backed by SQLite (small) or PostgreSQL / MySQL (production).

  • Runner, the worker. Pulls jobs and executes them in containers. Runner types: docker (default), kubernetes, ssh, digitalocean, exec (host runner), macstadium.

  • VCS integration, GitHub, GitLab, Gitea, Bitbucket. Drone receives webhooks, authenticates as the connected user via OAuth.

  • Pipeline, a YAML file (.drone.yml) at the repo root.

Pipeline shape#

# .drone.yml
kind: pipeline
type: docker
name: ci

trigger:
  event: [push, pull_request]
  branch: [main]

steps:
  - name: test
    image: node:22-alpine
    commands:
      - corepack enable
      - pnpm install --frozen-lockfile
      - pnpm test

  - name: build-push
    image: plugins/docker
    settings:
      registry: ghcr.io
      repo: ghcr.io/myorg/app
      tags: [ "${DRONE_COMMIT_SHA}" ]
      username: { from_secret: ghcr_user }
      password: { from_secret: ghcr_password }
    when:
      branch: [main]
      event: [push]

Multiple kind: pipeline blocks in one file run in parallel by default; explicit depends_on orders them.

Runners#

Runner

Detail

docker

Each step runs in its own container on the runner’s Docker daemon. The standard default.

kubernetes

Each step as a Pod. Right when Drone shares a cluster with workloads.

exec

Run on the runner host directly. Used for macOS / Windows / specialized hardware where containers do not fit.

ssh

Run on a remote host over SSH.

digitalocean / cloud-vm runners

Spin up a VM per job; tear down on completion.

Plugins#

A plugin is a published Docker image that runs as a step and reads its config from environment variables. The catalog covers Docker push, S3 upload, Slack notify, Helm, SSH deploy, GitHub Releases, artifact upload. Writing a plugin is just publishing a container image with the right main script.

Secrets#

Secrets are stored on the server; pipelines reference them via from_secret. Per-repo or per-organization scope; restrictable to certain events (pull_request from a fork is denied by default).

When to pick Drone#

  • Self-hosted CI without the operational weight of Jenkins.

  • Container-native shops where every step is already a container.

  • Small to mid-sized teams running their own VCS (Gitea, GitLab self-managed).

When to pick something else#

  • Code on GitHub at any scale; GitHub Actions is the lower-friction path.

  • Large multi-team estates needing strong RBAC and integration with enterprise SSO; Drone’s authz is lightweight.

  • Kubernetes-first CI/CD; Tekton’s CRD model integrates better.

References#

Contents