GitLab CI中Docker-in-Docker无法运行，Docker命令报错求助

问题概述 #

在GitLab CI中配置Docker-in-Docker（DinD）执行镜像构建时，Docker命令始终报错无法连接Docker守护进程，尝试两种配置方案均未解决。

第一次配置及错误信息 #

gitlab-ci.yml 配置 #

build-image_stage:
  stage: build-image
  image: docker:18.09.7
  services:
    - docker:18.09.7-dind
  rules:
    - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "main"
  script:
    - docker build -t bridge-image ./docker
    - docker tag bridge-image:latest ${AWS_ACCOUNT_ID}.dkr.ecr.ap-northeast-1.amazonaws.com/bridge/${ENVIRONMENT}:latest
    - docker push ${AWS_ACCOUNT_ID}.dkr.ecr.ap-northeast-1.amazonaws.com/bridge/${ENVIRONMENT}:latest
  variables:
    ENVIRONMENT: "stage"
    DOCKER_DRIVER: overlay2

错误日志 #

Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

已查看相关issue并尝试所有方案，但问题未解决。

第二次配置及执行日志 #

gitlab-ci.yml 配置 #

build-image_stage:
  stage: build-image
  image: docker:20.10.16
  services:
    - docker:20.10.16-dind
  rules:
    - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "main"
  script:
    - apk add nmap
    - nmap -sT -p- docker
    - docker build -t bridge-image ./docker
    - docker tag bridge-image:latest ${AWS_ACCOUNT_ID}.dkr.ecr.ap-northeast-1.amazonaws.com/bridge/${ENVIRONMENT}:latest
    - docker push ${AWS_ACCOUNT_ID}.dkr.ecr.ap-northeast-1.amazonaws.com/bridge/${ENVIRONMENT}:latest
  variables:
    ENVIRONMENT: "stage"
    DOCKER_TLS_CERTDIR: ''
    DOCKER_HOST: "tcp://docker:2375"
    FF_NETWORK_PER_BUILD: "true"

执行日志 #

$ apk add nmap
fetch https://dl-cdn.alpinelinux.org/alpine/v3.16/main/x86_64/APKINDEX.tar.gz
fetch https://dl-cdn.alpinelinux.org/alpine/v3.16/community/x86_64/APKINDEX.tar.gz
(1/7) Installing libgcc (11.2.1_git20220219-r2)
(2/7) Installing lua5.3-libs (5.3.6-r3)
(3/7) Installing libpcap (1.10.1-r0)
(4/7) Installing pcre (8.45-r2)
(5/7) Installing libssh2 (1.10.0-r2)
(6/7) Installing libstdc++ (11.2.1_git20220219-r2)
(7/7) Installing nmap (7.92-r2)
Executing busybox-1.35.0-r13.trigger
OK: 26 MiB in 29 packages
$ nmap -sT -p- docker
Starting Nmap 7.92 ( https://nmap.org ) at 2023-12-12 09:53 UTC
Nmap scan report for docker (127.0.0.1)
Host is up (0.000038s latency).
rDNS record for 127.0.0.1: localhost
All 65535 scanned ports on docker (127.0.0.1) are in ignored states.
Not shown: 65535 closed tcp ports (conn-refused)
Nmap done: 1 IP address (1 host up) scanned in 1.53 seconds
$ docker build -t bridge-image ./docker
Cannot connect to the Docker daemon at tcp://docker:2375. Is the docker daemon running?

解决方法 #

1. 确保GitLab Runner以特权模式运行 #

DinD需要Runner开启privileged权限，这是核心前提。检查Runner配置文件（通常为config.toml），确保对应Runner配置包含：

[runners.docker]
  privileged = true

修改后重启Runner服务。

2. 统一镜像与DinD服务版本并调整启动参数 #

确保主镜像和DinD服务的Docker版本完全一致，避免版本兼容性问题。同时给DinD服务添加启动参数禁用TLS：

services:
  - name: docker:20.10.16-dind
    command: ["--tls=false"]

3. 添加Docker守护进程等待逻辑 #

在执行docker build前，添加等待脚本确保Docker守护进程完全启动：

until docker info; do
  echo "等待Docker守护进程启动..."
  sleep 3
done

4. 优化变量配置 #

保留必要的变量，移除可能冲突的配置：

variables:
  ENVIRONMENT: "stage"
  DOCKER_TLS_CERTDIR: ""
  DOCKER_HOST: "tcp://docker:2375"

完整可行配置示例 #

build-image_stage:
  stage: build-image
  image: docker:20.10.16
  services:
    - name: docker:20.10.16-dind
      command: ["--tls=false"]
  rules:
    - if: $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == "main"
  script:
    - until docker info; do echo "等待Docker启动..."; sleep 3; done
    - docker build -t bridge-image ./docker
    - docker tag bridge-image:latest ${AWS_ACCOUNT_ID}.dkr.ecr.ap-northeast-1.amazonaws.com/bridge/${ENVIRONMENT}:latest
    - docker push ${AWS_ACCOUNT_ID}.dkr.ecr.ap-northeast-1.amazonaws.com/bridge/${ENVIRONMENT}:latest
  variables:
    ENVIRONMENT: "stage"
    DOCKER_TLS_CERTDIR: ""
    DOCKER_HOST: "tcp://docker:2375"

内容的提问来源于stack exchange，提问作者Shion