## Summary GitLab can add an [optional instance prefix](https://gitlab.com/gitlab-org/gitlab/-/work_items/388379) in front of runner and CI job tokens (admin setting `instance_token_prefix`, behind feature flag `custom_prefix_for_all_token_types`, disabled by default). With prefix `acme`, a runner token looks like `acme-glrt-...` instead of `glrt-...`. GitLab Runner does not expect this. Two places only look at the very start of the token, and both break once a prefix is added: - `network.TokenIsCreatedRunnerToken` in `network/gitlab.go` checks for `glrt-`. It decides whether `unregister` removes one runner manager or deletes the whole runner. - `helpers.ShortenToken` in `helpers/shorten_token.go` strips `glrt-`/`glcbt-`. It builds the short token used all over the runner. With a prefix in use, `unregister` deletes the entire runner instead of just one manager, and every runner on the instance gets the same short token, so different runners share caches and build directories. * Parent issue: https://gitlab.com/gitlab-org/gitlab/-/work_items/388379 * Rollout issue: https://gitlab.com/gitlab-org/gitlab/-/work_items/522940 ## Steps to reproduce Reproduced on a GDK: 1. In the Rails console, enable the flag and set the prefix: ```ruby Feature.enable(:custom_prefix_for_all_token_types) ApplicationSetting.current.update!(instance_token_prefix: 'acme') ``` 2. Create two instance runners in GitLab (Admin area > CI/CD > Runners > New instance runner). Their tokens should start with `acme-glrt-`. 3. Register runner 1 on two hosts. You can simulate this with two config directories, each with its own `.runner_system_id`, and runner 2 on a third host: `gitlab-runner register --non-interactive --config host-a/config.toml --url http://gdk.test:3000 --token acme-glrt-... --executor shell --name host-a` (same command for host-b with runner 1's token, and host-c with runner 2's token). 4. Look at the `runner=` field in the output: it is `acme-glrt` for all three hosts, although host-a/host-b and host-c belong to different runners. 5. To unregister, run `gitlab-runner unregister --config host-a/config.toml --all-runners`. 6. Runner 1 no longer exists in the GitLab UI, so host-b lost its runner too, although only host-a unregistered. ## Actual behavior - `unregister` on one host deletes the whole runner (`DELETE /api/v4/runners`), removing it for every other host sharing that runner. - `register --token acme-glrt-...` takes the legacy "verify existing token" path: it logs "Token specified trying to verify runner...", "If you want to register use the '-r' instead of '-t'.", and "is alive" instead of "is valid", and writes `id = 0` and no `token_obtained_at` to `config.toml`. - Every runner on the instance gets the same short token, `acme-glrt`, since `ShortenToken` strips not correctly. This short token is used in a few places, so different runners can collide. docker+machine runners on the same host with the same `MachineName` template can adopt or remove each other's machines. ## Expected behavior Tokens with an instance prefix should be handled the same as plain `glrt-` tokens: `unregister` should remove only that host's runner manager, `register` should use the normal path and log "is valid", and the short token should be taken from the token body, distinct per runner. ## Relevant logs and/or screenshots <details><summary> register / unregister output </summary> ```sh # register (host-a) Runtime platform arch=arm64 os=linux pid=19710 revision=eba7e9d6 version=v1.11.1-0.20260928083038-eba7e9d6eaa0 Token specified trying to verify runner... WARNING: If you want to register use the '-r' instead of '-t'. Verifying runner... is alive correlation_id=... runner=acme-glrt runner_name=host-a Runner registered successfully. Feel free to start it, but if it's running already the config should be automatically reloaded! # register (host-c, a different runner, same short token) Token specified trying to verify runner... Verifying runner... is alive correlation_id=... runner=acme-glrt runner_name=host-c # unregister (host-a) WARNING: Unregistering all runners Unregistering runner from GitLab succeeded correlation_id=... runner=acme-glrt runner_name=host-a ``` </details> ## Environment description Reproduced on GDK, with the `custom_prefix_for_all_token_types` feature flag enabled and `instance_token_prefix` set to `acme`. ### Used GitLab Runner version ``` Version: v1.11.1-0.20260928083038-eba7e9d6eaa0 Git revision: eba7e9d6 Git branch: HEAD GO version: go1.27.1 Built: 2026-09-28T08:30:38Z OS/Arch: linux/arm64 ``` ## Possible fixes Allow an optional alphanumeric instance prefix followed by a hyphen before `glrt-` and `glcbt-` in both `TokenIsCreatedRunnerToken` (`network/gitlab.go`) and `ShortenToken` (`helpers/shorten_token.go`), for example with a shared pattern `([A-Za-z0-9]+-)?`. `glrtr-` tokens (runners registered with a registration token) never get an instance prefix, so they stay as they are. A runner release with this fix is needed before GitLab enables the feature flag; the GitLab docs should state the minimum runner version once a prefix is configured.