GitLab Runner Pod缺失docker.sock问题求助

我通过Helm在Kubernetes中部署了GitLab Runner，基于docker:dind制作了包含Maven依赖的自定义镜像<my private-registry>/dind-java17-new:17。但GitLab运行该镜像的runner pod时，发现pod内缺失docker.sock。

GitLab Runner的values.yml配置：

runners:
  # runner configuration, where the multi line strings is evaluated as
  # template so you can specify helm values inside of it.
  #
  # tpl: https://helm.sh/docs/howto/charts_tips_and_tricks/#using-the-tpl-function
  # runner configuration: https://docs.gitlab.com/runner/configuration/advanced-configuration.html
  config: |
    [[runners]]
      executor = "kubernetes"
    [runners.kubernetes]
      privileged = true
      helper_image = "registry.gitlab.com/gitlab-org/gitlab-runner/gitlab-runner-helper:x86_64-782e15da"

曾在.gitlab-ci.yml尝试以下配置但无效：

variables:
  DOCKER_HOST: tcp://docker:2375
  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: ""
services:
  - name: <my private-registry>/dind-java17-new:17
    entrypoint: ["env", "-u", "DOCKER_HOST"]
    command: ["dockerd-entrypoint.sh"]

出现错误：

error during connect: Get "http://docker:2375/v1.24/version": dial tcp: lookup docker on 169.254.25.10:53: server misbehaving

方案一：挂载宿主机docker.sock（复用节点Docker环境） #

如果不需要在Pod内启动独立Docker服务，直接复用Kubernetes节点的Docker环境即可解决docker.sock缺失问题：

1. 修改Runner的values.yml，添加宿主机卷挂载配置：

runners:
  config: |
    [[runners]]
      executor = "kubernetes"
    [runners.kubernetes]
      privileged = true
      helper_image = "registry.gitlab.com/gitlab-org/gitlab-runner/gitlab-runner-helper:x86_64-782e15da"
      [[runners.kubernetes.volumes.host_path]]
        name = "docker-sock"
        mount_path = "/var/run/docker.sock"
        host_path = "/var/run/docker.sock"

2. 重新部署GitLab Runner：

helm upgrade --install gitlab-runner gitlab/gitlab-runner -f values.yml

3. 调整.gitlab-ci.yml，移除services和DOCKER_HOST相关配置，直接使用docker命令即可。

方案二：修复dind服务DNS解析问题（使用独立Docker环境） #

如果必须在Pod内启动dind服务，可通过以下方式修复DNS错误：

1. 修改服务别名与DOCKER_HOST
   在.gitlab-ci.yml中给dind服务设置明确别名，避免DNS解析问题：

variables:
  DOCKER_HOST: tcp://dind-service:2375
  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: ""
services:
  - name: <my private-registry>/dind-java17-new:17
    alias: dind-service
    entrypoint: ["env", "-u", "DOCKER_HOST"]
    command: ["dockerd-entrypoint.sh"]

2. 指定Runner的DNS服务器
   如果集群默认DNS存在异常，在Runner的values.yml中配置公共DNS：

runners:
  config: |
    [[runners]]
      executor = "kubernetes"
    [runners.kubernetes]
      privileged = true
      helper_image = "registry.gitlab.com/gitlab-org/gitlab-runner/gitlab-runner-helper:x86_64-782e15da"
      dns_policy = "None"
      [[runners.kubernetes.dns_config.nameservers]]
        value = "8.8.8.8"
      [[runners.kubernetes.dns_config.nameservers]]
        value = "1.1.1.1"

重新部署Runner后再执行CI任务。

3. 验证自定义dind镜像可用性
   本地测试镜像是否能正常启动dockerd：

docker run -it --privileged <my private-registry>/dind-java17-new:17 dockerd-entrypoint.sh

确认dockerd无报错并正常监听2375端口。

内容的提问来源于stack exchange，提问作者Saleh