CODEWITHSUNDEEP
dockerkubernetesminikube
RandomQuests
RandomQuests

Reputation: 755

Kubernetes: executable mounted through hostPath fails with found error

I am trying to run docker from my pod to launch docker containers (docker inside k8s). To get docker images from the host I am mounting docker.sock and docker command in my pod through hostPath. Even though I find the files mounted I cannot execute the docker command, it will fail with command not found error.

apiVersion: v1
kind: Pod
metadata:
  name: alphine
  labels:
    app: alphine
spec:
  containers:
  - name: alpine
    image: alpine
    securityContext:
      privileged: true
    volumeMounts:
    - name: tmp
      mountPath: /tmp
    - name: docker-sock
      mountPath: /var/run/docker.sock
    - name: docker-cmd  # docker command from host.
      mountPath: /usr/bin/docker
    - name: lib64  # for running docker from the host.
      mountPath: /lib64
      readOnly: true
    - name: usr-lib64  # for running docker from the host.
      mountPath: /usr/lib64
      readOnly: true
    command: ["sleep", "infinity"]
  volumes:
  - name: tmp
    emptyDir: {}
  - name: docker-cmd
    hostPath:
      path: /usr/bin/docker
      type: File
  - name: lib64
    hostPath:
      path: /lib64
      type: Directory
  - name: usr-lib64
    hostPath:
      path: /usr/lib64
      type: Directory
  - name: docker-sock
    hostPath:
      path: /var/run/docker.sock
      type: Socket

I am staring minikube with below command

minikube start --memory=16g --cpus=2 --disk-size=10g \
  -p mycluster \
  --extra-config=apiserver.enable-admission-plugins=PodSecurityPolicy \
  --addons=pod-security-policy --wait=all

The same does work in Docker in Docker environment. Where I will start my container with below command

 docker create
      --name=mypod
      --read-only
      --restart=on-failure
      -v /usr/bin/docker:/usr/bin/docker:ro
      -v /lib64:/lib64:ro
      -v /usr/lib64:/usr/lib64:ro
      -v /var/run/docker.sock:/var/run/docker.sock
      alphine

docker start mypod

Am I missing something here? Any pointers/reference is appreciated. Thanks in Advance.

Upvotes: 0

Views: 852

Answers (2)

RandomQuests
RandomQuests

Reputation: 755

There seems to be a difference in guest OS. I tried Ubuntu:latest instead alpine as my guest image and I was able to access the docker command from my guest.

Not sure if there is any security difference between these 2 guest OS

Upvotes: 0

Kamol Hasan
Kamol Hasan

Reputation: 13466

The hostPath of your minikube cluster isn't the same as your local machine. When you run the docker command on your local machine, it uses the hostPath of your machine where the files/directory exists. But these files/directories don't exist inside the minkube cluster node.

Solution:

  1. Create a Dockerfile and copy the files/directories while building the image:
FROM alphine:latest
COPY /var/run/docker.sock /var/run/docker.sock
... ...
... ...
CMD ["sleep", "infinity"]
  1. Use this image in your pod:
apiVersion: v1
kind: Pod
metadata:
  name: alphine
  labels:
    app: alphine
spec:
  containers:
  - name: your_image
    image: your_image:latest
    securityContext:
      privileged: true

Upvotes: 1

Related Questions