在CI中构建推送Quarkus Native容器遇Docker daemon连接失败的解决方法

问题概述 #

要构建CI工作流创建并推送Quarkus Native微容器，但长期遇到Docker命令无法运行的问题，报错：

Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running? 

先后在gitlab.com、github.com尝试均失败，遂搭建自托管Gitea实例并配置Act Runner，已遵循dind配置教程，但问题依旧。所有CI步骤可正常运行，仅执行Maven构建容器镜像时触发连接失败错误。尝试过更换作业镜像、手动安装Docker、使用Docker配置Action等方法，均无效。

环境配置 #

Act Runner的Kubernetes Deployment配置 #

apiVersion: apps/v1
kind: Deployment
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: act-runner
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    spec:
      containers:
        - command:
            - sh
            - '-c'
            - >-
              while ! nc -z localhost 2376 </dev/null; do echo 'waiting for
              docker daemon...'; sleep 5; done; /sbin/tini -- /opt/act/run.sh
          env:
            - name: DOCKER_HOST
              value: tcp://localhost:2376
            - name: DOCKER_CERT_PATH
              value: /certs/client
            - name: DOCKER_TLS_VERIFY
              value: '1'
            - name: GITEA_INSTANCE_URL
              value: http://gitea-http:3000
            - name: GITEA_RUNNER_REGISTRATION_TOKEN
              valueFrom:
                secretKeyRef:
                  key: token
                  name: runner-secret
          image: gitea/act_runner:latest
          imagePullPolicy: Always
          name: runner
          resources: {}
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
            - mountPath: /certs
              name: docker-certs
            - mountPath: /data
              name: runner-data
            
        - env:
            - name: DOCKER_TLS_CERTDIR
              value: /certs
          image: docker:23.0.6-dind
          imagePullPolicy: IfNotPresent
          name: daemon
          resources: {}
          securityContext:
            privileged: true
          terminationMessagePath: /dev/termination-log
          terminationMessagePolicy: File
          volumeMounts:
            - mountPath: /certs
              name: docker-certs
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      terminationGracePeriodSeconds: 30
      volumes:
        - emptyDir: {}
          name: docker-certs
        - name: runner-data
          persistentVolumeClaim:
            claimName: act-runner-vol

CI工作流定义 #

name: Main Push
on:
  push:
    branches:
      - main

jobs:
  verify:
    name: Verify
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up GraalVM JDK
        uses: graalvm/setup-graalvm@v1
        with:
          java-version: '21'
          distribution: 'graalvm'

      - name: Set up Maven
        uses: stCarolas/setup-maven@v4
        with:
          maven-version: '3.9.6'

      - name: Maven Verify
        run: mvn --batch-mode --update-snapshots verify

  push_container:
    needs: verify
    name: Push Container
    runs-on: ubuntu-latest
    container:
      image: catthehacker/ubuntu:act-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up GraalVM JDK
        uses: graalvm/setup-graalvm@v1
        with:
          java-version: '21'
          distribution: 'graalvm'

      - name: Set up Maven
        uses: stCarolas/setup-maven@v4
        with:
          maven-version: '3.9.6'

      - name: Maven Install
        run: mvn --batch-mode --update-snapshots install -Dnative -Dquarkus.container-image.build=true -Dquarkus.container-image.push=true -Dquarkus.container-image.username=dscham -Dquarkus.container-image.password=${{ secrets.GITEA_TOKEN }}

补充测试结果 #

执行Docker连接测试后输出：

Client:
 Version:           24.0.9-2
 API version:       1.43
 Go version:        go1.21.9
 Git commit:        293681613032e6d1a39cc88115847d3984195c24
 Built:             Wed Jan 31 20:53:14 UTC 2024
 OS/Arch:           linux/amd64
 Context:           default
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

解决方案 #

核心问题分析 #

作业使用了独立容器catthehacker/ubuntu:act-latest，该容器默认尝试连接本地Unix socket /var/run/docker.sock，但并未继承Act Runner中配置的Docker环境变量（指向dind容器的TCP端口2376），也未挂载TLS证书目录，导致无法连接到dind守护进程。

修复步骤 #

1. 修改工作流，传递Docker环境变量并挂载证书

更新push_container作业的容器配置，添加Docker连接所需的环境变量和证书目录挂载：

push_container:
  needs: verify
  name: Push Container
  runs-on: ubuntu-latest
  container:
    image: catthehacker/ubuntu:act-latest
    env:
      DOCKER_HOST: tcp://localhost:2376
      DOCKER_CERT_PATH: /certs/client
      DOCKER_TLS_VERIFY: '1'
    volumes:
      - /certs/client:/certs/client
  steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up GraalVM JDK
        uses: graalvm/setup-graalvm@v1
        with:
          java-version: '21'
          distribution: 'graalvm'

      - name: Set up Maven
        uses: stCarolas/setup-maven@v4
        with:
          maven-version: '3.9.6'

      - name: Verify Docker Connection
        run: docker info

      - name: Maven Install
        run: mvn --batch-mode --update-snapshots install -Dnative -Dquarkus.container-image.build=true -Dquarkus.container-image.push=true -Dquarkus.container-image.username=dscham -Dquarkus.container-image.password=${{ secrets.GITEA_TOKEN }}

2. 备选方案：移除作业容器，直接使用Runner环境

如果不需要独立作业容器，可删除container字段，直接使用Act Runner的基础环境，该环境已预先配置好Docker连接：

push_container:
  needs: verify
  name: Push Container
  runs-on: ubuntu-latest
  steps:
      # 步骤保持不变

3. 确保作业容器内有Docker客户端

若catthehacker/ubuntu:act-latest未预装Docker客户端，需在步骤中添加安装命令：

- name: Install Docker Client
  run: |
    apt-get update && apt-get install -y --no-install-recommends docker.io

内容的提问来源于stack exchange，提问作者dscham