未做任何变更，Gitlab Runner+docker-machine启动失败求助

问题背景 #

我配置了使用docker-machine执行器的GitLab Runner，用于按需创建AWS EC2实例，配置文件如下：

concurrent = 10
check_interval = 30

[[runners]]
  name = "gitlab-runner-manager"
  limit = 3
  url = "https://git.domain.com"
  id = 18
  token = "12dcfvgbhnjfcvgbhjnk-9w2"
  token_obtained_at = 2023-01-12T06:08:06Z
  token_expires_at = 0001-01-01T00:00:00Z
  executor = "docker+machine"
  [runners.cache]
    Type = "s3"
    Shared = true
    MaxUploadedArchiveSize = 0
    [runners.cache.s3]
      ServerAddress = "s3.amazonaws.com"
      BucketName = "domain-gitlab-runner-manager-cache"
      BucketLocation = "us-east-1"
  [runners.docker]
    tls_verify = false
    image = "alpine"
    privileged = true
    disable_entrypoint_overwrite = false
    oom_kill_disable = false
    disable_cache = true
    shm_size = 0
  [runners.machine]
    IdleCount = 1
    IdleScaleFactor = 0.0
    IdleCountMin = 0
    IdleTime = 1800
    MachineDriver = "amazonec2"
    MachineName = "gitlab-runner-autoscale-%s"
    MachineOptions = [
      "amazonec2-region=us-east-1",
      "amazonec2-vpc-id=vpc-123",
      "amazonec2-subnet-id=subnet-123",
      "amazonec2-iam-instance-profile=gitlab-manager-instance-profile",
      "amazonec2-request-spot-instance=true",
      "amazonec2-spot-price=0.50",
      "amazonec2-use-private-address=true",
      "amazonec2-private-address-only=true",
      "amazonec2-tags=product,gitlab-runner,environment,shared",
      "amazonec2-security-group=gitlab-runner-manager-sg",
      "amazonec2-instance-type=t3.large",
      "amazonec2-root-size=100",
    ]
  [[runners.machine.autoscaling]]
    Periods = ["* * 1-17 * * mon-fri *"]
    IdleCount = 1
    IdleTime = 3600
    Timezone = "UTC"
  [[runners.machine.autoscaling]]
    Periods = ["* * * * * sat,sun *"]
    IdleCount = 0
    IdleTime = 3600
    Timezone = "UTC"

近期服务器开始报错，日志片段如下：

Feb 14 08:25:21 ip-10-10-0-251.ec2.internal gitlab-runner[2138]: ERROR: Error creating machine: Error running provisioning: Error running "sudo apt-get update": ssh command error:  driver=amazonec2 name=runner-nxw1xfxl-gitlab-runner-autoscale-1676363082-24ebaeda operation=create
Feb 14 08:25:21 ip-10-10-0-251.ec2.internal gitlab-runner[2138]: ERROR: command : sudo apt-get update                driver=amazonec2 name=runner-nxw1xfxl-gitlab-runner-autoscale-1676363082-24ebaeda operation=create
Feb 14 08:25:21 ip-10-10-0-251.ec2.internal gitlab-runner[2138]: ERROR: err     : exit status 100                    driver=amazonec2 name=runner-nxw1xfxl-gitlab-runner-autoscale-1676363082-24ebaeda operation=create
Feb 14 08:25:21 ip-10-10-0-251.ec2.internal gitlab-runner[2138]: ERROR: output  : Get:1 http://security.ubuntu.com/ubuntu focal-security InRelease [114 kB]  driver=amazonec2 name=runner-nxw1xfxl-gitlab-runner-autoscale-1676363082-24ebaeda operation=create
Feb 14 08:25:21 ip-10-10-0-251.ec2.internal gitlab-runner[2138]: ERROR: Reading package lists...                     driver=amazonec2 name=runner-nxw1xfxl-gitlab-runner-autoscale-1676363082-24ebaeda operation=create
Feb 14 08:25:21 ip-10-10-0-251.ec2.internal gitlab-runner[2138]: ERROR: W: GPG error: http://archive.ubuntu.com/ubuntu focal InRelease: Splitting up /var/lib/apt/lists/archive.ubuntu.com_ubuntu_dists_focal_InRelease into data and signature failed  driver=amazonec2 name=runner-nxw1xfxl-gitlab-runner-autoscale-1676363082-24ebaeda operation=create
Feb 14 08:25:21 ip-10-10-0-251.ec2.internal gitlab-runner[2138]: ERROR: E: The repository 'http://archive.ubuntu.com/ubuntu focal InRelease' is not signed.  driver=amazonec2 name=runner-nxw1xfxl-gitlab-runner-autoscale-1676363082-24ebaeda operation=create

报错显示EC2实例创建时执行sudo apt-get update失败，提示Ubuntu仓库未签名，请问如何解决？

问题原因 #

这个错误是因为Docker Machine初始化EC2实例时，默认使用的Ubuntu镜像或镜像源出现GPG签名验证问题，常见诱因包括：

• 镜像源的GPG密钥过期或未正确配置
• EC2实例无法正常访问Ubuntu官方源的签名服务器
• Docker Machine使用的旧版本镜像模板存在兼容性问题

解决方法 #

1. 指定最新的Ubuntu官方AMI ID #

AWS的Ubuntu官方镜像会定期更新，直接指定对应区域的最新Focal（20.04）镜像ID，避免使用旧镜像：
在MachineOptions数组中添加以下配置：

"amazonec2-ami=ami-0c7217cdde317cfec"

注：以上是us-east-1区域的Ubuntu 20.04 LTS官方镜像ID，其他区域可在AWS控制台查找对应最新AMI ID

2. 替换为AWS区域专属Ubuntu镜像源 #

AWS提供了区域内的Ubuntu镜像源，稳定性和速度更优，可通过自定义provision脚本替换默认源：

• 创建自定义provision脚本（例如provision.sh）：

#!/bin/bash
# 替换为us-east-1区域的AWS镜像源，其他区域修改对应前缀
sudo sed -i 's/archive.ubuntu.com/us-east-1.ec2.archive.ubuntu.com/g' /etc/apt/sources.list
# 更新GPG密钥
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32
sudo apt-get update

• 在GitLab Runner配置的MachineOptions中添加指定脚本的参数：

"provisioning-script=/path/to/your/provision.sh"

注意替换为实际脚本的绝对路径

3. 升级GitLab Runner和Docker Machine版本 #

旧版本的GitLab Runner或Docker Machine可能存在镜像兼容问题，升级到最新稳定版本：

• 升级GitLab Runner：

sudo apt-get update && sudo apt-get install --upgrade gitlab-runner

• 升级Docker Machine：下载最新版本的二进制文件替换旧文件

4. 临时跳过GPG验证（仅测试用，不推荐） #

如果需要临时紧急解决，可以修改provision步骤跳过apt的GPG验证，但这会降低系统安全性：
在provision脚本中将apt-get update替换为：

sudo apt-get update --allow-unauthenticated

内容的提问来源于stack exchange，提问作者Sean