GitLab自托管Runner用Docker executor登录Docker报错求助

问题背景 #

在Windows系统下使用GitLab CI推送镜像至容器仓库，此前用共享Runner一切正常，切换为自托管Runner（Docker executor）后，执行docker login时出现主机解析失败的错误。

错误信息 #

$ echo "$CI_REGISTRY_PASSWORD" | docker login $CI_REGISTRY -u $CI_REGISTRY_USER --password-stdin

error during connect: Post "http://docker:2375/v1.24/auth": dial tcp: lookup docker on 192.168.65.7:53: no such host 

当前.gitlab-ci.yml配置 #

stages:
   - test
   - build
run_tests:
   stage: test
   script:
       - echo "Testing"
   only:
       - merge_requests

build_image:
    stage: build
    image: docker:20.10.16
    services:
       - docker:20.10.16-dind
    variables:
       DOCKER_TLS_CERTDIR: "/certs"
    before_script:
       - echo "$CI_REGISTRY_PASSWORD" | docker login $CI_REGISTRY -u $CI_REGISTRY_USER --password-stdin
    script:
       - docker build -t registry.gitlab.com/caronethiagoivan/ci-cd-frontend .
       - docker push registry.gitlab.com/caronethiagoivan/ci-cd-frontend
    rules:
        - if: $CI_PIPELINE_SOURCE == "merge_request_event"

解决方案 #

1. 调整CI变量，指定Docker主机地址 #

Windows环境下，Docker executor的dind服务默认docker主机名可能无法正常解析，直接在build_image的变量中指定DOCKER_HOST为本地TCP地址：

build_image:
    stage: build
    image: docker:20.10.16
    services:
       - docker:20.10.16-dind
    variables:
       DOCKER_TLS_CERTDIR: "/certs"
       DOCKER_HOST: tcp://localhost:2375  # 添加此变量
    before_script:
       - echo "$CI_REGISTRY_PASSWORD" | docker login $CI_REGISTRY -u $CI_REGISTRY_USER --password-stdin
    script:
       - docker build -t registry.gitlab.com/caronethiagoivan/ci-cd-frontend .
       - docker push registry.gitlab.com/caronethiagoivan/ci-cd-frontend
    rules:
        - if: $CI_PIPELINE_SOURCE == "merge_request_event"

2. 检查自托管Runner的config.toml配置 #

确保Runner配置满足dind运行要求，重点检查以下项：

[[runners]]
  name = "Windows Docker Runner"
  url = "https://gitlab.com/"
  token = "你的Runner令牌"
  executor = "docker"
  [runners.docker]
    tls_verify = false
    image = "docker:20.10.16"
    privileged = true  # 必须开启，dind需要特权模式启动Docker守护进程
    volumes = ["/cache", "/certs/client"]  # 挂载证书目录，适配TLS配置
    network_mode = "bridge"

3. 配置Windows Docker Desktop #

• 打开Docker Desktop设置，进入Docker Engine页面，确保开启hosts中的TCP监听：

  {
    "hosts": ["tcp://localhost:2375", "npipe://"]
  }
  

• 如果使用TLS认证，需确保DOCKER_TLS_VERIFY=1和DOCKER_CERT_PATH=/certs/client变量在CI中正确设置。

4. 验证连接可用性 #

在before_script中添加测试命令，确认Docker守护进程可正常访问：

before_script:
   - ping localhost -n 3  # Windows环境测试网络连通性
   - docker info  # 验证Docker守护进程响应

内容的提问来源于stack exchange，提问作者marcelo gallardo