Docker daemon issue when using a local ecr image

Drone Support
1

Hi,

We are in the process of migration to kubernetes runners and there is a strange behavior when I use our own copy of plugins/ecr image. This is a 1:1 copy from the version on dockerhub, we just keep it in our ECR repo.

The following step is used for image building and pushing:

local buildPushImage(env, tag) = {
  name: 'build_push_image_%(env)s' % { env: env},
  image: 'ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/public/plugins/ecr:latest',
  pull: 'if-not-exists',
  settings: {
    repo: 'ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/flybox/dip-cdc',
    registery: 'ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com',
    region: 'us-east-1',
    repository_policy: 'ecr_repository_policy.json',
    tags: [
        'latest',
        tag
    ],
  },
  environment: {
    PLUGIN_CREATE_REPOSITORY: true,
    PLUGIN_PULL_IMAGE: false,
  },
};

This results in the classic error Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

Now when I change the image URL to:

  image: 'plugins/ecr:latest',

everything works and the build is proceeding.

Should we mount that /var/run folder? I removed those lines in the k8s runner migration process and seems like it is redundant.

Any help would be appreciated,

Erez

2

Plugins that build and publish docker images require privileged mode in order to start a docker daemon (docker-in-docker). Drone maintains a whitelist of such plugin images that are automatically run in private mode (plugins/docker, plugins/ecr). If you are attempting to use an alternate image, it would not exist in the whitelist, and would therefore lack the permissions needed to start the Docker daemon.

You can solve this by updating the following runner environment variable, and adding your image to the whitelist: https://docs.drone.io/runner/kubernetes/configuration/reference/drone-runner-privileged-images/

DRONE_RUNNER_PRIVILEGED_IMAGES=ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/public/plugins/ecr

Example above, note that the image tag must be omitted

1 Like