AWS CodeBuild执行报错：无法连接Docker daemon求助

问题背景 #

使用AWS CodeBuild构建项目时触发COMMAND_EXECUTION_ERROR，报错信息为Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?。使用的自定义镜像基于amazonlinux2-x86_64-standard:5.0，已添加pnpm和Nginx，相关配置及报错日志如下：

自定义Dockerfile #

FROM public.ecr.aws/codebuild/amazonlinux2-x86_64-standard:5.0

RUN yum update -y && yum install -y gcc-c++ make

RUN npm install -g pnpm@8.9.0

RUN yum clean all

WORKDIR /app

buildspec.yml配置 #

"version": 0.2

phases:
  install:
    runtime-versions:
      nodejs: 18
  pre_build:
    commands:
#      - echo Begin pull nginx:stable-alpine3.17-slim
#      - docker pull nginx:stable-alpine3.17-slim
      - echo Logging in to Amazon ECR...
      - aws ecr get-login-password --region ${AWS_DEFAULT_REGION} | docker login --username ${AWS_USER_NAME} --password-stdin ${AWS_ACCOUNT_ID}.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com.cn
      - REPOSITORY_URI=${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_DEFAULT_REGION}.amazonaws.com.cn/${IMAGE_REPO_NAME}
      - COMMIT_HASH=$(echo ${CODEBUILD_RESOLVED_SOURCE_VERSION} | cut -c 1-7)
      - IMAGE_TAG=${ENV_LATEST}-${COMMIT_HASH:=latest}
  build:
    commands:
      - echo change to tencent npm
      - echo Install started
      - pnpm install
      - echo Build started
      - pnpm run build:${PROJECT_ENV}
      - echo Copy dist resource
      - cp -r dist docker/
      - echo Building the docker image...
      - docker build -t ${REPOSITORY_URI}:${ENV_LATEST} ./docker/
      - docker tag ${REPOSITORY_URI}:${ENV_LATEST} ${REPOSITORY_URI}:${IMAGE_TAG}
  post_build:
    commands:
      - echo Pushing the Docker image...
      - docker push ${REPOSITORY_URI}:${ENV_LATEST}
      - docker push ${REPOSITORY_URI}:${IMAGE_TAG}
cache:
  paths:
    - '/root/.npm/**/*'

报错日志 #

[Container] 2023/10/17 02:42:48 Running command docker build -t ${REPOSITORY_URI}:${ENV_LATEST} ./docker/
ERROR: Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

[Container] 2023/10/17 02:42:51 Command did not exit successfully docker build -t ${REPOSITORY_URI}:${ENV_LATEST} ./docker/ exit status 1
[Container] 2023/10/17 02:42:51 Phase complete: BUILD State: FAILED
[Container] 2023/10/17 02:42:51 Phase context status code: COMMAND_EXECUTION_ERROR Message: Error while executing command: docker build -t ${REPOSITORY_URI}:${ENV_LATEST} ./docker/. Reason: exit status 1
[Container] 2023/10/17 02:42:51 Entering phase POST_BUILD
[Container] 2023/10/17 02:42:51 Running command echo Pushing the Docker image...
Pushing the Docker image...

[Container] 2023/10/17 02:42:52 Running command docker push ${REPOSITORY_URI}:${ENV_LATEST}
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

[Container] 2023/10/17 02:42:52 Command did not exit successfully docker push ${REPOSITORY_URI}:${ENV_LATEST} exit status 1
[Container] 2023/10/17 02:42:52 Phase complete: POST_BUILD State: FAILED
[Container] 2023/10/17 02:42:52 Phase context status code: COMMAND_EXECUTION_ERROR Message: Error while executing command: docker push ${REPOSITORY_URI}:${ENV_LATEST}. Reason: exit status 1

问题分析 #

报错核心原因：

1. CodeBuild容器未启用特权模式，Docker daemon无法获取足够权限启动
2. ECR登录命令使用错误用户名参数（ECR登录用户名固定为AWS，无需自定义变量）
3. 自定义镜像环境中Docker daemon未手动启动（官方standard镜像默认不会自动拉起daemon）

解决方案 #

1. 开启CodeBuild项目特权模式 #

进入AWS CodeBuild控制台，找到目标项目：

• 点击「编辑」→「环境」标签页
• 在「环境配置」区域勾选「启用特权模式」
• 保存项目配置

2. 在buildspec.yml中添加Docker daemon启动命令 #

在pre_build阶段开头加入启动并验证Docker服务的命令：

pre_build:
  commands:
    - echo Starting Docker daemon...
    - service docker start
    - docker info  # 验证Docker服务状态
    # 后续原有命令...

3. 修正ECR登录命令的用户名参数 #

将登录命令中的--username ${AWS_USER_NAME}替换为固定值--username AWS：

- aws ecr get-login-password --region ${AWS_DEFAULT_REGION} | docker login --username AWS --password-stdin ${AWS_ACCOUNT_ID}.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com.cn

修正后的完整buildspec.yml #

version: 0.2

phases:
  install:
    runtime-versions:
      nodejs: 18
  pre_build:
    commands:
      - echo Starting Docker daemon...
      - service docker start
      - docker info
      - echo Logging in to Amazon ECR...
      - aws ecr get-login-password --region ${AWS_DEFAULT_REGION} | docker login --username AWS --password-stdin ${AWS_ACCOUNT_ID}.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com.cn
      - REPOSITORY_URI=${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_DEFAULT_REGION}.amazonaws.com.cn/${IMAGE_REPO_NAME}
      - COMMIT_HASH=$(echo ${CODEBUILD_RESOLVED_SOURCE_VERSION} | cut -c 1-7)
      - IMAGE_TAG=${ENV_LATEST}-${COMMIT_HASH:=latest}
  build:
    commands:
      - echo change to tencent npm
      - echo Install started
      - pnpm install
      - echo Build started
      - pnpm run build:${PROJECT_ENV}
      - echo Copy dist resource
      - cp -r dist docker/
      - echo Building the docker image...
      - docker build -t ${REPOSITORY_URI}:${ENV_LATEST} ./docker/
      - docker tag ${REPOSITORY_URI}:${ENV_LATEST} ${REPOSITORY_URI}:${IMAGE_TAG}
  post_build:
    commands:
      - echo Pushing the Docker image...
      - docker push ${REPOSITORY_URI}:${ENV_LATEST}
      - docker push ${REPOSITORY_URI}:${IMAGE_TAG}
cache:
  paths:
    - '/root/.npm/**/*'

内容的提问来源于stack exchange，提问作者Manster