Ubuntu22.04环境下AKS v1.27中Docker-in-Docker启动异常求助

我们在AKS v1.27集群上运行Docker-in-Docker容器，此前基于Ubuntu18.04的镜像可正常工作，但切换到Ubuntu22.04镜像后出现以下问题：

• ScaledJob创建的容器中Docker服务无法自动启动，但手动执行service docker start命令可以正常启动
• 首次运行docker.sh脚本会报错：Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?，再次运行脚本则可正常启动Docker服务

相关配置文件 #

基础镜像Dockerfile #

FROM ubuntu:22.04
#2-Enable Ubuntu Packages
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    curl \
    wget \
  && rm -rf /var/lib/apt/lists/*
#install docker daemon inside docker
RUN curl -fsSL https://download.docker.com/linux/ubuntu/gpg |  gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
RUN echo \
   "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu \
   $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
RUN apt-get update
RUN apt-get install docker-ce docker-ce-cli containerd.io -y

WORKDIR /azp
COPY ./vstsagent/ .
COPY ./start.sh .
COPY ./docker.sh .
RUN chmod +x start.sh docker.sh
CMD ["./docker.sh"]
ENTRYPOINT ["./start.sh"]

ADO镜像Dockerfile #

FROM myregistry/agetImage
RUN apt-get install docker-ce docker-ce-cli containerd.io -y
COPY ./daemon.json /etc/docker/
COPY ./config.json /root/.docker/
WORKDIR /azp/
RUN rm -rf start.sh 
COPY ./start.sh .
RUN rm -rf docker.sh
COPY ./docker.sh .
RUN sed -i 's/ulimit -Hn/# ulimit -Hn/g' /etc/init.d/docker
RUN chmod 777 start.sh
RUN chmod 777 docker.sh
RUN usermod -aG docker root
ENV AGENT_ALLOW_RUNASROOT="true"
CMD ["./docker.sh"]
ENTRYPOINT [ "./start.sh"]

docker.sh脚本 #

#!/bin/bash
echo "DOCKER STARTS HERE"
service docker start
docker version
docker ps

daemon.json配置 #

{
    "storage-driver": "vfs"
}

ScaledJob配置 #

apiVersion: keda.sh/v1alpha1
kind: ScaledJob
spec:
  jobTargetRef:
    template:
      spec:
        affinity:
          nodeAffinity:
            preferredDuringSchedulingIgnoredDuringExecution:
            - preference:
                matchExpressions:
                - key: kubernetes.azure.com/mode
                  operator: Exists
                  values:
                  - xxxxxxxxxxxxxxx
                - key: topology.disk.csi.azure.com/zone
                  operator: Exists
                  values:
                  - westeurope-2
              weight: 2
        containers:
        - name: xxxxxxxxxxxx
          image: myregistry/vstsnew/vsts_customxxxx
          imagePullPolicy: Always
          resources:
            limits:
              cpu: 1500m
              memory: 10Gi
            requests:
              cpu: 500m
              memory: 6Gi
          securityContext:
            allowPrivilegeEscalation: true
            privileged: true
          env:
          - name: AZP_URL
            value: xxxxxxxxxxxxxxxxxxxxx
          - name: AZP_TOKEN
            value: xxxxxxxxxxxxxxxxxxxxxxxxxxxx
          - name: AZP_POOL
            value: xxxxxxxxxxxx
          - name: AZP_AGENT_NAME
            value: DockerAgentLinux
          volumeMounts:
          - mountPath: /mnt
            name: xxxxxxxxxxxxx
        nodeSelector:
          agentpool: xxxxxxxxxxxxxxxx
        volumes:
        - name: xxxxxxxx
          persistentVolumeClaim:
            claimName: xxxxxxxxxxxxxxxxxx
  pollingInterval: 30
  successfulJobsHistoryLimit: 5
  failedJobsHistoryLimit: 5
  maxReplicaCount: 6
  minReplicaCount: 1
  scalingStrategy:
    strategy: "default"
  triggers:
  - type: azure-pipelines
    metadata:
      poolID: "xxxx"
      organizationURLFromEnv: "AZP_URL"
      personalAccessTokenFromEnv: "AZP_TOKEN"

问题根源 #

Ubuntu22.04默认改用systemd作为初始化系统，原有的service命令只是兼容层，直接执行service docker start时，systemd相关环境变量未完全加载，导致Docker daemon启动后需要短暂初始化时间，首次执行docker命令时daemon还未就绪。

修复步骤 #

1. 修改docker.sh脚本，等待Docker daemon就绪 #

给脚本添加等待逻辑，确保Docker服务完全启动后再执行后续命令：

#!/bin/bash
echo "DOCKER STARTS HERE"
# 启动Docker服务
service docker start

# 循环等待Docker daemon就绪
until docker info >/dev/null 2>&1; do
    echo "Waiting for Docker daemon to start..."
    sleep 2
done

# 执行后续Docker操作
docker version
docker ps

2. 改用systemctl直接管理Docker服务（推荐） #

Ubuntu22.04原生支持systemctl，直接用它启动Docker更可靠，调整脚本如下：

#!/bin/bash
echo "DOCKER STARTS HERE"
# 声明容器环境，避免systemctl报错
export container=docker
# 启动Docker服务
systemctl start docker

# 等待Docker daemon就绪
until docker info >/dev/null 2>&1; do
    echo "Waiting for Docker daemon to start..."
    sleep 2
done

docker version
docker ps

3. 优化镜像构建 #

ADO镜像的Dockerfile中重复执行了apt-get install docker-ce...，可删除该步骤，减少镜像体积和构建时间。

4. 验证containerd兼容性 #

Ubuntu22.04上Docker默认使用containerd作为runtime，当前daemon.json中的vfs存储驱动是兼容的，无需修改。

验证方式 #

修改后重新构建镜像，更新ScaledJob的镜像版本，触发Job运行，观察首次执行docker.sh时是否不再报错，Docker服务能自动启动并正常执行后续命令。

内容的提问来源于stack exchange，提问作者Vowneee