如何通过容器内的Jenkins重建并重启docker-compose中的backend-api服务？

Absolutely, this requirement is completely feasible, and your core setup is on the right track. The issue you're facing boils down to missing permissions, tooling, and volume mounts that let the Jenkins container interact properly with the host's Docker environment and your docker-compose setup. Here's how to fix it step by step:

1. Fix Docker Socket Permissions for Jenkins User #

You've already mounted /var/run/docker.sock into the Jenkins container, which is essential—but the Jenkins user inside the container doesn't have permission to use it by default. The Docker socket on the host belongs to the docker group, so we need to add the Jenkins user to this group.

Option A: Update Jenkins Dockerfile #

Modify your ./jenkins/Dockerfile to add the Jenkins user to the host's docker group (we'll dynamically fetch the group ID to avoid mismatches):

FROM jenkins/jenkins:lts
# Switch to root for setup
USER root
# Install dependencies for Docker CLI
RUN apt-get update && apt-get install -y apt-transport-https ca-certificates curl gnupg2 software-properties-common
# Add Docker official GPG key and repository
RUN curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
RUN echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/debian $(lsb_release -cs) stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null
# Install Docker CLI
RUN apt-get update && apt-get install -y docker-ce-cli
# Add Jenkins user to docker group (match host's docker group ID)
RUN GROUP_ID=$(stat -c '%g' /var/run/docker.sock) && groupadd -g $GROUP_ID docker && usermod -aG docker jenkins
# Switch back to Jenkins user
USER jenkins

Option B: Adjust docker-compose.yml for Jenkins Service #

If you don't want to modify the Dockerfile, you can set the user ID/group ID directly in docker-compose.yml to match your host's docker group:
First, get your host's docker group ID by running this on the host:

getent group docker | cut -d: -f3

Then update the jenkins service in docker-compose.yml:

jenkins:
  build: ./jenkins
  volumes:
    - jenkins_data:/var/jenkins_home
    - /var/run/docker.sock:/var/run/docker.sock
    # Mount your docker-compose project directory into Jenkins
    - ./:/jenkins-project
  # Replace 1001 with your host's docker group ID from the previous command
  user: "jenkins:1001"

2. Install docker-compose in Jenkins Container #

Since you're using docker-compose to manage services, the Jenkins container needs the docker-compose tool installed. Add this to your Jenkins Dockerfile (under the USER root section):

RUN curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose && chmod +x /usr/local/bin/docker-compose

3. Configure Jenkins Build Job to Rebuild/Restart the Service #

Now set up a Jenkins freestyle or pipeline job with the following build steps:

Freestyle Job Build Step (Execute Shell) #

# Navigate to the mounted project directory
cd /jenkins-project
# Rebuild and restart the backend-api service in one command
docker-compose up -d --build backend-api

Pipeline Job Example #

pipeline {
    agent any
    stages {
        stage('Rebuild & Restart Backend API') {
            steps {
                sh 'cd /jenkins-project && docker-compose up -d --build backend-api'
            }
        }
    }
}

Key Notes to Avoid Pitfalls #

• Permission Issues: If you still get permission denied errors when accessing docker.sock, you can temporarily run chmod 666 /var/run/docker.sock on the host (not recommended for production, but useful for testing). For production, stick to the group membership method.
• Force Full Rebuild: If you want to bypass Docker's build cache and rebuild the backend-api image from scratch, add the --no-cache flag:

  docker-compose build --no-cache backend-api && docker-compose up -d backend-api
  

• CloudBees Docker Plugin: That plugin is designed for managing Docker-based Jenkins agents, not for directly controlling the host's Docker environment. Using raw docker-compose commands is a simpler, more direct approach for your use case.

Your original overall architecture is solid—you just needed to fill in the gaps for Docker permissioning, tooling, and volume access. With these changes, Jenkins will be able to rebuild and restart your backend-api service seamlessly from inside its container.

内容的提问来源于stack exchange，提问作者Robert Engel