K8S集群Docker-in-Docker Jenkins代理构建镜像时DNS解析失败

环境配置 #

dind-client镜像Dockerfile #

FROM jenkins/jnlp-agent-docker
USER root

COPY entrypoint.sh /entrypoint.sh
RUN chown jenkins:jenkins /entrypoint.sh
RUN chmod +x /entrypoint.sh

USER jenkins
ENTRYPOINT "/entrypoint.sh"

entrypoint.sh脚本（等待Docker守护进程就绪） #

#!/usr/bin/env bash

RETRIES=6

sleep_exp_backoff=1

for((i=0;i<RETRIES;i++)); do
    docker version
    dockerd_available=$?
    if [ $dockerd_available == 0 ]; then
        break 
    fi
    sleep ${sleep_exp_backoff}
    sleep_exp_backoff="$((sleep_exp_backoff * 2))"
done

exec /usr/local/bin/jenkins-agent "$@"

dind-daemon镜像Dockerfile #

FROM docker:20.10.14-dind

Jenkins Helm Chart的values.yaml配置（docker-agent） #

dind:
    podName: docker-agent
    customJenkinsLabels: docker-agent
    image: [url]/docker-client
    tag: latest
    envVars:
     - name: DOCKER_HOST
       value: "tcp://localhost:2375"
    alwaysPullImage: true
    yamlTemplate:  |-  
     spec: 
         containers:
           - name: dind-daemon 
             image: [url]/docker-daemon:latest
             securityContext: 
               privileged: true
             env: 
               - name: DOCKER_TLS_CERTDIR
                 value: ""       

待构建的Jenkins镜像Dockerfile #

FROM docker.io/jenkins/jenkins:lts-jdk17

ENV JAVA_OPTS="-Djenkins.install.runSetupWizard=false"

# Add Jenkins init files
COPY src/ /usr/share/jenkins/ref/

COPY --chown=jenkins:jenkins plugins.txt /usr/share/jenkins/ref/plugins.txt
RUN jenkins-plugin-cli --verbose --plugin-file /usr/share/jenkins/ref/plugins.txt

USER jenkins

错误现象 #

在Jenkins流水线执行docker build步骤（rc = sh(returnStatus: true, script: "docker build -t ${REGISTRY}/${REPO_NAME}/${NAME} .")）时，镜像构建的RUN jenkins-plugin-cli阶段出现DNS解析失败，无法解析updates.jenkins.io域名，错误日志如下：

12:39:03  Retrieving update center information
12:39:03  Created cache at: /var/jenkins_home/.cache/jenkins-plugin-management-cli
12:39:03  Update center URL: https://updates.jenkins.io/update-center.json?version=2.346.1
12:39:03  Cache miss for: update-center-2.346.1
12:39:03  Unable to retrieve JSON from https://updates.jenkins.io/update-center.json?version=2.346.1: updates.jenkins.io: Temporary failure in name resolution
12:39:03  Unable to retrieve JSON from https://updates.jenkins.io/update-center.json?version=2.346.1: updates.jenkins.io
12:39:03  io.jenkins.tools.pluginmanager.impl.UpdateCenterInfoRetrievalException: Error getting update center json
12:39:03    at io.jenkins.tools.pluginmanager.impl.PluginManager.getJson(PluginManager.java:810)
12:39:03    at io.jenkins.tools.pluginmanager.impl.PluginManager.getUCJson(PluginManager.java:832)
12:39:03    at io.jenkins.tools.pluginmanager.impl.PluginManager.start(PluginManager.java:217)
12:39:03    at io.jenkins.tools.pluginmanager.impl.PluginManager.start(PluginManager.java:181)
12:39:03    at io.jenkins.tools.pluginmanager.cli.Main.main(Main.java:70)
12:39:03  Caused by: java.io.IOException: Unable to retrieve JSON from https://updates.jenkins.io/update-center.json?version=2.346.1: updates.jenkins.io
12:39:03    at io.jenkins.tools.pluginmanager.impl.PluginManager.getViaHttpWithResponseHandler(PluginManager.java:1344)
12:39:03    at io.jenkins.tools.pluginmanager.impl.PluginManager.getJson(PluginManager.java:796)
12:39:03    ... 4 more
12:39:03  Caused by: java.net.UnknownHostException: updates.jenkins.io
12:39:03    at java.base/java.net.InetAddress$CachedAddresses.get(InetAddress.java:801)
12:39:03    at java.base/java.net.InetAddress.getAllByName0(InetAddress.java:1509)
12:39:03    at java.base/java.net.InetAddress.getAllByName(InetAddress.java:1367)
12:39:03    at java.base/java.net.InetAddress.getAllByName(InetAddress.java:1301)
12:39:03    at org.apache.http.impl.conn.SystemDefaultDnsResolver.resolve(SystemDefaultDnsResolver.java:45)
12:39:03    at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:112)
12:39:03    at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:376)
12:39:03    at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:393)
12:39:03    at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)
12:39:03    at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186)
12:39:03    at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
12:39:03    at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:110)
12:39:03    at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
12:39:03    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:72)
12:39:03    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:221)
12:39:03    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:165)
12:39:03    at io.jenkins.tools.pluginmanager.impl.PluginManager.getViaHttpWithResponseHandler(PluginManager.java:1336)
12:39:03    ... 5 more
12:39:03  Error getting update center json
12:39:05  The command '/bin/sh -c jenkins-plugin-cli --verbose --plugin-file /usr/share/jenkins/ref/plugins.txt' returned a non-zero code: 1

测试验证 #

在同一K8S集群内手动测试，以下场景均能正常解析updates.jenkins.io：

• 直接在dind-daemon容器内执行nslookup updates.jenkins.io；
• 在dind-daemon容器内启动alpine容器，执行nslookup updates.jenkins.io。

疑问 #

为何仅在docker build过程中出现DNS解析失败？

解决方案 #

1. 为Docker守护进程指定DNS服务器 #

修改Helm values.yaml中的dind-daemon配置，添加DOCKER_OPTS环境变量指定集群DNS服务地址（替换为你的K8S集群DNS IP，通常是kube-dns.kube-system.svc.cluster.local对应的IP，比如10.96.0.10）：

spec: 
    containers:
      - name: dind-daemon 
        image: [url]/docker-daemon:latest
        securityContext: 
          privileged: true
        env: 
          - name: DOCKER_TLS_CERTDIR
            value: ""
          - name: DOCKER_OPTS
            value: "--dns=10.96.0.10"

2. 在Docker Build时显式指定DNS #

在流水线的docker build命令中添加--dns参数：

docker build --dns=10.96.0.10 -t ${REGISTRY}/${REPO_NAME}/${NAME} .

3. 清理Docker缓存 #

执行命令清理dind-daemon内的Docker缓存，避免缓存镜像的DNS配置问题影响构建：

docker system prune -af

之后重新执行构建流程。

4. 检查容器网络模式 #

确认dind-daemon容器的网络模式配置，确保Docker守护进程创建的构建容器能继承Pod的网络配置，从而获取正确的DNS解析能力。

内容的提问来源于stack exchange，提问作者rokpoto.com