GitLab CI/CD在AWS Fargate上使用Kaniko持续故障求助

问题所在 #

我在使用Kaniko在AWS Fargate上构建Docker镜像时，GitLab CI流水线出现异常。流水线可在Fargate上启动任务，但不同Dockerfile会触发各类错误，如过多syslink调用、特定apt-get命令执行失败。我需要协助解决自定义Kaniko镜像的这些问题。

采用该架构是为了避免使用DinD（Docker in Docker），降低AWS Fargate的成本。我已通过所有Dockerfile测试了DinD方案，且运行正常。

根据GitLab官方文档，我使用以下Dockerfile构建AWS Fargate任务定义所需的镜像：

FROM --platform=linux/amd64 gcr.io/kaniko-project/executor AS kaniko

FROM --platform=linux/amd64 ubuntu:20.04

# ----------------------------------------------------------------
# Copy the kaniko executable and cloud container registry helpers.
# Then, set up the tool.
# ----------------------------------------------------------------
COPY --from=kaniko /kaniko/executor /kaniko/
COPY --from=kaniko /kaniko/docker-credential-gcr /kaniko/
COPY --from=kaniko /kaniko/docker-credential-ecr-login /kaniko/

ENV DOCKER_CONFIG /kaniko/.docker/
ENV DOCKER_CREDENTIAL_GCR_CONFIG /kaniko/.config/gcloud/docker_credential_gcr_config.json
ENV PATH ${PATH}:/kaniko

RUN mkdir -p /kaniko/.docker \
    && mkdir -p /kaniko/ssl \
    && docker-credential-gcr config --token-source=env

# ---------------------------------------------------------------------
# Install tini - a very small 'init' process that helps processing signals sent to the container properly.
# ---------------------------------------------------------------------
ARG TINI_VERSION=v0.19.0

RUN apt-get update \
    && apt-get install -y curl \
    && curl -Lo /usr/local/bin/tini https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini-amd64 \
    && chmod +x /usr/local/bin/tini

# --------------------------------------------------------------------------
# Install and configure sshd.
# --------------------------------------------------------------------------
RUN apt-get install -y openssh-server \
    && mkdir -p /var/run/sshd

EXPOSE 22

# ----------------------------------------
# Install GitLab CI required dependencies.
# ----------------------------------------
ARG GITLAB_RUNNER_VERSION=v13.6.0

RUN curl -Lo /usr/local/bin/gitlab-runner https://gitlab-runner-downloads.s3.amazonaws.com/${GITLAB_RUNNER_VERSION}/binaries/gitlab-runner-linux-amd64 \
    && chmod +x /usr/local/bin/gitlab-runner \
    && gitlab-runner --version

RUN apt-get install -y git-lfs \
    && git lfs install --skip-repo

# ------------------------------------------------------------------------------------
# Execute a startup script.
# ------------------------------------------------------------------------------------
COPY test.sh /usr/local/bin/
RUN chmod +x /usr/local/bin/test.sh
ENTRYPOINT ["tini", "--", "/usr/local/bin/test.sh"]

对应的test.sh文件内容如下：

#!/bin/sh

if command -v tini >/dev/null 2>&1; then
  echo "tini is installed."
else
  echo "tini is not installed."
fi

# Create a folder to store user's SSH keys if it does not exist.
USER_SSH_KEYS_FOLDER=~/.ssh
[ ! -d ${USER_SSH_KEYS_FOLDER} ] && mkdir -p ${USER_SSH_KEYS_FOLDER}

# Copy contents from the `SSH_PUBLIC_KEY` environment variable
# to the `$USER_SSH_KEYS_FOLDER/authorized_keys` file.
# The environment variable must be set when the container starts.
echo ${SSH_PUBLIC_KEY} > ${USER_SSH_KEYS_FOLDER}/authorized_keys

# Clear the `SSH_PUBLIC_KEY` environment variable.
unset SSH_PUBLIC_KEY

# Start the SSH daemon
exec /usr/sbin/sshd -D

该方案存在诸多问题，我发现官方Kaniko Dockerfile使用FROM Scratch，导致我无法按照文档步骤配置镜像。

预期行为：
GitLab CI流水线应通过Kaniko在AWS Fargate上构建Docker镜像，并将镜像推送到指定镜像仓库。

解决方案建议 #

1. 调整镜像基础，避免环境冲突 #

官方Kaniko镜像基于Scratch/Alpine，仅保留核心运行组件，你用Ubuntu作为基础镜像会引入大量冗余系统库，容易和Kaniko运行时产生冲突，引发syslink调用异常、命令执行失败等问题。建议改用Kaniko的Alpine版本作为基础镜像，在此之上添加所需组件：

# 选用Kaniko的Alpine版本，方便安装依赖且环境更简洁
FROM gcr.io/kaniko-project/executor:alpine

# 安装openssh-server、curl、git-lfs等依赖
RUN apk add --no-cache openssh-server curl git-lfs

# 配置SSHD允许root登录（适配GitLab Runner场景）
RUN mkdir -p /var/run/sshd \
    && sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin yes/' /etc/ssh/sshd_config

EXPOSE 22

# 升级GitLab Runner到较新版本（避免旧版本兼容性问题）
ARG GITLAB_RUNNER_VERSION=v16.0.0
RUN curl -Lo /usr/local/bin/gitlab-runner https://gitlab-runner-downloads.s3.amazonaws.com/${GITLAB_RUNNER_VERSION}/binaries/gitlab-runner-linux-amd64 \
    && chmod +x /usr/local/bin/gitlab-runner

# 配置Git LFS
RUN git lfs install --skip-repo

# 安装tini
ARG TINI_VERSION=v0.19.0
RUN curl -Lo /usr/local/bin/tini https://github.com/krallin/tini/releases/download/${TINI_VERSION}/tini-amd64 \
    && chmod +x /usr/local/bin/tini

# 复制启动脚本
COPY test.sh /usr/local/bin/
RUN chmod +x /usr/local/bin/test.sh

ENTRYPOINT ["tini", "--", "/usr/local/bin/test.sh"]

2. 修复Kaniko运行权限与环境变量 #

• 确保Kaniko执行时拥有正确的权限，在GitLab CI配置中提前生成ECR登录配置：

  echo "{\"auths\":{\"$ECR_REGISTRY\":{\"auth\":\"$(echo -n "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" | base64)\"}}}" > /kaniko/.docker/config.json
  

• 简化环境变量配置，确保Kaniko能正确识别路径：

  ENV DOCKER_CONFIG=/kaniko/.docker
  ENV PATH="$PATH:/kaniko"
  

3. 优化GitLab CI流水线配置 #

直接在流水线中调用Kaniko executor，无需通过SSHD间接执行，减少复杂度：

build:
  stage: build
  tags:
    - fargate
  script:
    # 生成ECR认证配置
    - echo "{\"auths\":{\"$ECR_REGISTRY\":{\"auth\":\"$(echo -n "$AWS_ACCESS_KEY_ID:$AWS_SECRET_ACCESS_KEY" | base64)\"}}}" > /kaniko/.docker/config.json
    # 执行Kaniko构建并推送镜像
    - /kaniko/executor --context $CI_PROJECT_DIR --dockerfile $CI_PROJECT_DIR/Dockerfile --destination $ECR_REGISTRY/$CI_PROJECT_NAME:$CI_COMMIT_SHA

4. 排查apt-get失败问题 #

如果特定Dockerfile中的apt-get命令失败，可尝试：

• 在目标Dockerfile中替换为AWS或国内镜像源，加速包下载
• 检查Fargate任务的网络配置，确保允许访问外部HTTP/HTTPS地址

内容的提问来源于stack exchange，提问作者Aldo