CODEWITHSUNDEEP
dockergitlabgitlab-cidocker-in-docker
mcguip
mcguip

Reputation: 6287

gitlab-ci docker-in-docker access to insecure registry

When configuring a gitlab-ci for building docker images and pushing them to my gitlab's insecure registry, I encountered several errors. My gitlab-ci.yaml is laid out below:

stages:
  - build
  - deploy

variables:
  GIT_SUBMODULE_STRATEGY: recursive
  CONTAINER_IMAGE: XXX:$CI_COMMIT_REF_NAME

# The insecure-registry flag 
services:
  - docker:dind

build_container:
  image: docker:latest
  stage: build
  before_script:
    - echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" "$CI_REGISTRY" --password-stdin

  script:
    - docker build --pull -t $CONTAINER_IMAGE .
    - docker push $CONTAINER_IMAGE

The first error was:

  $ docker login -u gitlab-ci-token -p $CI_JOB_TOKEN myregistry.gitlab.com
  WARNING! Using --password via the CLI is insecure. Use --password-stdin.
  Warning: failed to get default registry endpoint from daemon (Cannot connect 
  to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon 
  running?). Using system default: https://index.docker.io/v1/
  Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the 
  docker daemon running?

This was resolved by updating the login command to 

echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" myregistry.gitlab.com --password-stdin

Unfortunately after updating, I encountered another error:

$ echo "$CI_REGISTRY_PASSWORD" | docker login -u "$CI_REGISTRY_USER" myregistry.gitlab.com --password-stdin
Error response from daemon: Get https://myregistry.gitlab.com/v2/: dial tcp XX.XX.XXX.XXX:443: getsockopt: connection refused

How Can I resolve this?

Upvotes: 15

Views: 21462

Answers (1)

mcguip
mcguip

Reputation: 6287

Like any other docker installation, it is necessary to instruct the docker daemon to allow connections to insecure registries. In order to do this in the context of the docker-in-docker service, one must pass this configuration to the service. This can be done by updating your gitlab-ci.yaml to specify the service as:

services:
  - name: docker:dind
    command: ["--insecure-registry=myregistry.gitlab.com"]

Upvotes: 55

Related Questions