GitLab Runner构建Docker镜像并推送至本地私有仓库问题排查

我正在基于Docker搭建GitLab CI/CD流程，目标是在GitLab Runner上构建Docker镜像并推送到本地非安全私有仓库，但执行docker build时持续报错。

第一个错误：无法解析docker主机 #

error during connect: Post "http://docker:2375/v1.24/build?buildargs=%7B%7D&cachefrom=%5B%5D&cgroupparent=&cpuperiod=0&cpuquota=0&cpusetcpus=&cpusetmems=&cpushares=0&dockerfile=Dockerfile&labels=%7B%7D&memory=0&memswap=0&networkmode=default&rm=1&shmsize=0&t=test_project&target=&ulimits=null&version=1": dial tcp: lookup docker on xxx.xxx.xxx.xxx:53: no such host

我的.gitlab-ci.yml相关配置如下：

...

package:
  image: docker:latest
  stage: package
  variables:
    DOCKER_HOST: tcp://docker:2375
    DOCKER_DRIVER: overlay2
    DOCKER_TLS_CERTDIR: ""
  services: 
    - name: docker:20-dind
      alias: docker
      command: ["--tls=false", "--insecure-registry=$DOCKER_REGISTRY_IP:$DOCKER_REGISTRY_PORT"] # OPTIONS
  script: 
    - docker build -t $DOCKER_IMAGE_NAME . # Error occurred
    - docker tag $DOCKER_IMAGE_NAME $DOCKER_REGISTRY_IP:$DOCKER_REGISTRY_PORT/$DOCKER_IMAGE_NAME
    - docker push $DOCKER_REGISTRY_IP:$DOCKER_REGISTRY_PORT/$DOCKER_IMAGE_NAME
  cache:
    key: "$DOCKER_IMAGE_NAME"
    policy: pull
    paths:
      - build

...

第一个错误的解决尝试 #

我将GitLab Runner配置中的privileged设为true，解决了第一个错误。Runner配置如下：

[[runners]]
  name = "docker-runner"
  url = "http://192.165.100.2/"
  id = 10
  token = "47e5LRRhgBPcnhfYdDxB"
  token_obtained_at = 2022-12-28T06:50:33Z
  token_expires_at = 0001-01-01T00:00:00Z
  executor = "docker"
  [runners.custom_build_dir]
  [runners.cache]
    MaxUploadedArchiveSize = 0
    [runners.cache.s3]
    [runners.cache.gcs]
    [runners.cache.azure]
  [runners.docker]
    tls_verify = false
    image = "alpine:latest"
    privileged = true                #set to true
    disable_entrypoint_overwrite = false
    oom_kill_disable = false
    disable_cache = false
    volumes = ["/cache"]
    shm_size = 0

第二个错误：无法连接Docker守护进程 #

第一个错误解决后，出现第二个错误：

Cannot connect to the Docker daemon at tcp://docker:2375. Is the docker daemon running?

我在docker:dind服务中添加--tls=false命令，解决了第二个错误。修改后的services配置：

services: 
    - name: docker:20-dind
      alias: docker
      command: ["--tls=false"]

第三个错误：HTTPS请求被HTTP响应拒绝 #

此时"no such host"错误解决，但出现第三个错误：

Get "https://xxx.xxx.xxx.xxx:5000/v2/": http: server gave HTTP response to HTTPS client

我尝试添加--insecure-registry命令解决HTTPS问题，修改后的services配置：

services: 
    - name: docker:20-dind
      alias: docker
      command: ["--tls=false", "--insecure-registry=$DOCKER_REGISTRY_IP:$DOCKER_REGISTRY_PORT"]

但预期的HTTPS问题未解决，反而回到最初的"no such host"错误。

疑问 #

1. 为何--insecure-registry会导致--tls=false失效？
2. 如何在GitLab Runner上构建Docker镜像并推送到本地私有仓库？

内容的提问来源于stack exchange，提问作者DevJaewoo