Unable to run rootless docker in docker

[mrgrain]

Description

When running in a rootless docker container, it is not easily possible to run Docker in Docker (or Docker out of Docker) commands. This is due to missing permissions of the rootless user to access the mounted unix:///var/run/docker.sock

Platforms affected

• Azure DevOps
• GitHub Actions - Standard Runners
• GitHub Actions - Larger Runners

Runner images affected

• Ubuntu 18.04
• Ubuntu 20.04
• Ubuntu 22.04
• macOS 10.15
• macOS 11
• macOS 12
• Windows Server 2019
• Windows Server 2022

Image version and build link

https://github.com/mrgrain/repro-rootless-dind/actions/runs/3377152959

Is it regression?

No

Expected behavior

In order of preference:

• The non-root user inside the container should have permissions to access the socket. No configuration should be needed.
• I can see why this should be an explicit opt-in. I'd expect an additional option on the container property. e.g.

  container:
    image: jsii/superchain:1-buster-slim-node14
    dind: true

• Using options: --group-add is a nice enough work around. However currently we have to specify the numeric id of the docker group to make this work. Furthermore this id appears to be different on various images. I also suspect it can change at any time.
  It seems that options: --group-add docker will use the group id from inside the container, which will be wrong. So I guess we would need a stable way to get the correct id. Maybe this could be something like {{ options: --group-add {{runner.docker-group-id}}. Or even a documented id for the group that's fix and consistent across all images.

Actual behavior

The docker command fails with the following error

Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.24/containers/json": dial unix /var/run/docker.sock: connect: permission denied

Repro steps

https://github.com/mrgrain/repro-rootless-dind/blob/main/.github/workflows/rootless-dind.yml

[igorboskovic3]

Hi @mrgrain, we will take a look and get back to you.

[al-cheb]

Hey @mrgrain.
We don't manage the container task and I don't think we should create a new group due to maintenance concern. You could dynamically get a docker id group and pass it to next job:

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
       dockerId: ${{ steps.get_docker_id.outputs.id }}
    steps:
       - name: Get docker id
         id: get_docker_id
         run: |
            echo "id=$(cut -d: -f3 < <(getent group docker))" >> $GITHUB_OUTPUT
  works-with-group:
    needs: build
    runs-on: ubuntu-latest
    container:
      image: jsii/superchain:1-buster-slim-node14
      options: --group-add ${{ needs.build.outputs.dockerId }}
    steps:
      - run: whoami
      - run: id
      - run: docker ps

[mrgrain]

Thanks @al-cheb that's at least a consistent workaround. 👍🏻

[al-cheb]

Close as external.