GitLab私有Runner配置Docker-in-Docker遇group docker not found错误求正确配置

问题现象 #

在GitLab CI/CD私有Runner上执行Docker相关流水线时失败，docker:dind服务无法正常启动，最终报错无法连接Docker daemon；但使用共享Runner时流水线可正常运行。

错误日志 #

Preparing the "docker" executor
Using Docker executor with image docker:latest ...
Starting service docker:dind ...
Pulling docker image docker:dind ...
Using docker image sha256:e072c2e5e5506659f7d5794b6f47fcaa3bb84c8b165609bf199ce483386cd0fe for docker:dind with digest docker@sha256:a2e34bde4cb23eaef4f3d5016c78f4a7ee06b65f80d07c7ba69a1e262977a97a ...
Waiting for services to be up and running (timeout 30 seconds)...
*** WARNING: Service runner-tx15ndy-project-3223950-concurrent-0-cfd5aa554405b7e4-docker-0 probably didn't start properly.
Health check error:
service "runner-tx15ndy-project-3223950-concurrent-0-cfd5aa554405b7e4-docker-0-wait-for-service" timeout
Health check container logs:
Service container logs:
2023-04-17T13:16:23.860176290Z Certificate request self-signature ok
2023-04-17T13:16:23.860224269Z subject=CN = docker:dind server
2023-04-17T13:16:23.882609115Z /certs/server/cert.pem: OK
2023-04-17T13:16:24.829195915Z Certificate request self-signature ok
2023-04-17T13:16:24.829221989Z subject=CN = docker:dind client
2023-04-17T13:16:24.851576744Z /certs/client/cert.pem: OK
2023-04-17T13:16:24.973935031Z time="2023-04-17T13:16:24.973766812Z" level=info msg="Starting up"
2023-04-17T13:16:24.976897417Z time="2023-04-17T13:16:24.976800011Z" level=warning msg="could not change group /var/run/docker.sock to docker: group docker not found"
...
$ docker build --tag $CAM_NATS_IMAGE .
ERROR: Cannot connect to the Docker daemon at tcp://docker:2375. Is the docker daemon running?

当前CI/CD配置（简化版） #

# Build the cam service images
build-cam-service:
  stage: build-cam-service
  image: docker:latest
  services:
    - docker:dind
  script:
    # Build prod images
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY      
    [build some images and push to gitlab container registry]       

test-cam-requester:
  stage: test-cam-service
  image: docker:latest
  services:
    - docker:dind
  script:
      - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY  
      [use docker pull and docker run to run and test the images]

私有Runner配置 #

[[runners]]
  name = "dind 2"
  url = "https://gitlab.com/"
  token = "***"
  executor = "docker"
  [runners.docker]
    tls_verify = false
    image = "docker:23.0.1-cli-alpine3.17"
    privileged = true
    disable_cache = false
    volumes = ["/cache"]
    shm_size = 0
  [runners.cache]

尝试过的方法 #

曾配置Runner挂载主机Docker套接字：

volumes = ["/var/run/docker.sock:/var/run/docker.sock", "/cache"]

流水线可运行，但测试任务会在Runner本机创建容器，而非docker:dind服务容器内，不符合Docker-in-Docker的隔离需求。

解决方案 #

1. 统一Docker客户端与dind服务版本 #

避免版本不兼容导致启动失败，将CI job的image与docker:dind服务版本对齐，比如都使用23.0.1版本：

image: docker:23.0.1-cli
services:
  - docker:23.0.1-dind

2. 配置正确的Docker环境变量 #

默认docker:dind会启用TLS，监听2376端口，但当前CI job尝试连接非TLS的2375端口，导致连接失败。需在CI job中添加对应环境变量，二选一即可：

方式一：启用TLS连接（推荐）

variables:
  DOCKER_HOST: tcp://docker:2376
  DOCKER_TLS_CERTDIR: "/certs"

该配置会自动使用dind生成的证书进行安全连接。

方式二：禁用TLS（仅测试环境使用）

variables:
  DOCKER_HOST: tcp://docker:2375
  DOCKER_TLS_CERTDIR: ""

3. 检查Runner主机配置 #

• 确保Runner主机内核支持overlay2存储驱动（Docker默认推荐）
• 确认主机已开启iptables转发，避免网络隔离问题：

  sysctl net.ipv4.ip_forward=1
  

• 无需挂载/var/run/docker.sock，保留Runner配置中的volumes = ["/cache"]即可，保证Docker-in-Docker的隔离性。

配置调整后重新触发流水线，即可在私有Runner上正常运行Docker-in-Docker流程。

内容的提问来源于stack exchange，提问作者Debby Mendez