CODEWITHSUNDEEP
dockerkubernetesbamboodocker-in-docker
bear
bear

Reputation: 11615

Permission denied with Docker in Docker in Atlassian Bamboo Server

I'm trying to build a docker image using DIND with Atlassian Bamboo.

I've created the deployment/ StatefulSet as follows:

---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app: bamboo
  name: bamboo
  namespace: csf
spec:
  replicas: 1
  serviceName: bamboo
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: bamboo
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: bamboo
    spec:
      containers:
      - image: atlassian/bamboo-server:latest
        imagePullPolicy: IfNotPresent
        name: bamboo-server
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        securityContext:
          privileged: true
        volumeMounts:
        - name: bamboo-home
          mountPath: /var/atlassian/application-data/bamboo
        - mountPath: /opt/atlassian/bamboo/conf/server.xml
          name: bamboo-server-xml
          subPath: bamboo-server.xml
        - mountPath: /var/run 
          name: docker-sock
      volumes:
      - name: bamboo-home
        persistentVolumeClaim:
          claimName: bamboo-home
      - configMap:
          defaultMode: 511
          name: bamboo-server-xml
        name: bamboo-server-xml
      - name: docker-sock 
        hostPath: 
          path: /var/run
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      terminationGracePeriodSeconds: 30

Note that I've set privileged: true in securityContext to enable this.

However, when trying to run docker images, I get a permission error:

Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Post http://%2Fvar%2Frun%2Fdocker.sock/v1.40/containers/create: dial unix /var/run/docker.sock: connect: permission denied.
See '/var/atlassian/application-data/bamboo/appexecs/docker run --help'

Am I missing something wrt setting up DIND?

Upvotes: 0

Views: 3595

Answers (3)

bianchi
bianchi

Reputation: 500

A better way to handle this is to run a sidecar container - docker:dind, and export DOCKER_HOST=tcp://dind:2375 in the main Bamboo container. This way you will invoke Docker in a dind container and won't need to mount /var/run/docker.sock

Upvotes: 0

Boris Van Hardeveld
Boris Van Hardeveld

Reputation: 66

The /var/run/docker.sock file on the host system is owned by a different user than the user that is running the bamboo-server container process.

Without knowing any details about your cluster, I would assume docker runs as 'root' (UID=0). The bamboo-server runs as 'bamboo', as can be seen from its Dockerfile, which will normally map to a UID in the 1XXX range on the host system. As these users are different and the container process did not receive any specific permissions over the (host) socket, the error is given.

So I think there are two approaches possible:

  • Or the container process continues to run as the 'bamboo' user, but is given sufficient permissions on the host system to access /var/run/docker.sock. This would normally mean adding the UID the bamboo user maps to on the host system to the docker group on the host system. However, making changes to the host system might or might not be an option depending on the context of your cluster, and is tricky in a cluster context because the pod could migrate to a different node where the changes were not applied and/or the UID changes.

  • Or the container is changed as to run as a sufficiently privileged user to begin with, being the root user. There are two ways to accomplish this: 1. you extend and customize the Atlassian provided base image to change the user or 2. you override the user the container runs as at run-time by means of the 'runAsUser' and 'runAsGroup' securityContext instructions as specified here. Both should be '0'.

Upvotes: 2

Jakub
Jakub

Reputation: 8830

As mentioned in the documentation here

If you want to run docker as non-root user then you need to add it to the docker group.

Create the docker group if it does not exist

$ sudo groupadd docker

Add your user to the docker group.

$ sudo usermod -aG docker $USER

Log out and log back in so that your group membership is re-evaluated.

$ newgrp docker

Verify that you can run docker commands without sudo

$ docker run hello-world

If that doesn't help you can change the permissions of docker socket to be able to connect to the docker daemon /var/run/docker.sock.

sudo chmod 666 /var/run

Upvotes: 0

Related Questions