Docker容器-如何将套接字文件的GID设置为groupID 130？

Question

这是码头场景中的码头。

下面是安装了docker客户端的Dockerfile中的相应代码：

FROM jenkins/jenkins:2.190.2

ENV DEBIAN_FRONTEND=noninteractive

# Official Jenkins image does not include sudo, change to root user
USER root

# Used to set the docker group ID
# Set to 497 by default, which is the groupID used by AWS Linux ECS instance
ARG DOCKER_GID=497

# Create Docker Group with GID
# Set default value of 497 if DOCKER_GID set to blank string by Docker compose
RUN groupadd -g ${DOCKER_GID:-497} docker

# Install base packages for docker, docker-compose & ansible
# apt-key adv --keyserver keyserver.ubuntu.com --recv-keys AA8E81B4331F7F50 && \
RUN apt-get update -y && \
    apt-get -y install bc \
                    gawk \
                    libffi-dev \
                    musl-dev \
                    apt-transport-https \
                    curl \
                    python3 \
                    python3-dev \
                    python3-setuptools \
                    gcc \
                    make \
                    libssl-dev \
                    python3-pip 

# Used at build time but not runtime
ARG DOCKER_VERSION=5:19.03.4~3-0~debian-stretch

# Install the latest Docker CE binaries and add user `jenkins` to the docker group
RUN apt-get update && \
    apt-get -y install apt-transport-https \
    ca-certificates \
    curl \
    gnupg-agent \
    software-properties-common && \
    curl -fsSL https://download.docker.com/linux/$(. /etc/os-release; echo "$ID")/gpg > /tmp/dkey; apt-key add /tmp/dkey && \
    add-apt-repository \
      "deb [arch=amd64] https://download.docker.com/linux/$(. /etc/os-release; echo "$ID") \
      $(lsb_release -cs) \
      stable" && \
    apt-get update && \
    apt-get -y install docker-ce=${DOCKER_VERSION:-5:19.03.4~3-0~debian-stretch}  \
        docker-ce-cli=${DOCKER_VERSION:-5:19.03.4~3-0~debian-stretch} \
        containerd.io && \
    usermod -aG docker jenkins


ARG DOCKER_COMPOSE=1.24.1

# Install docker compose
RUN curl -L "https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE:-1.24.1}/docker-compose-$(uname -s)-$(uname -m)" \
    -o /usr/local/bin/docker-compose && \
    chmod +x /usr/local/bin/docker-compose && \
    pip3 install ansible boto3

# Change to jenkins user
USER jenkins

# Add jenkins plugin
COPY plugins.txt /usr/share/jenkins/plugins.txt
RUN /usr/local/bin/install-plugins.sh < /usr/share/jenkins/plugins.txt

docker-compose.yml在启动对接容器时创建挂载点(/var/run/docker.sock)，映射到对接主机的套接字文件：

version: '2'

volumes:
  jenkins_home:
    external: true

services:
  jenkins:
    build:
      context: .
      args:
        DOCKER_GID: ${DOCKER_GID}
        DOCKER_VERSION: ${DOCKER_VERSION}
        DOCKER_COMPOSE: ${DOCKER_COMPOSE}
    volumes:
      - jenkins_home:/var/jenkins_home
      - /var/run/docker.sock:/var/run/docker.sock
    ports:
      - "8080:8080"

运行命令DOCKER_GID=130 docker-compose up -d后

但是，码头容器中的/var/run/docker.sock的用户in和清单如下所示：

​

​

在docker主机(膝上型计算机)中，docker组的组id为130。

todobackend$ ls -l /var/run/docker.sock
srw-rw---- 1 root docker 0 Nov 24 21:04 /var/run/docker.sock
todobackend$ cat /etc/group | grep docker
docker:x:130:user
todobackend$ 
todobackend$ uname -a
Linux mohet01-ubuntu 4.15.0-70-generic #79-Ubuntu SMP Tue Nov 12 10:36:11 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
todobackend$

在容器中，docker组的组id为130。

todobackend$ 
todobackend$ docker exec -it 1bb8eedbf59e bash
jenkins@1bb8eedbf59e:/$
jenkins@1bb8eedbf59e:/$ ls -l /var/run/docker.sock
srw-rw---- 1 nobody nogroup 0 Nov 25 03:04 /var/run/docker.sock
jenkins@1bb8eedbf59e:/$
jenkins@1bb8eedbf59e:/$ cat /etc/group | grep nogroup
nogroup:x:65534:
jenkins@1bb8eedbf59e:/$ cat /etc/passwd | grep nobody
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
jenkins@1bb8eedbf59e:/$ cat /etc/group | grep docker
docker:x:130:jenkins
jenkins@1bb8eedbf59e:/$
jenkins@1bb8eedbf59e:/$ docker info
Client:
 Debug Mode: false

Server:
ERROR: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.40/info: dial unix /var/run/docker.sock: connect: permission denied
errors pretty printing info
jenkins@1bb8eedbf59e:/$

但是码头容器中的挂载点(/var/run/docker.sock)并不是id 130组的一部分，因此，来自jenkins容器的码头客户端是无法解决以下来自jenkins管道的错误，这是预期的：

[1;33m=> Creating cache volume...
[0mGot permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Post http://%2Fvar%2Frun%2Fdocker.sock/v1.40/volumes/create: dial unix /var/run/docker.sock: connect: permission denied
Makefile:43: recipe for target 'test' failed

如何将组id 130设置为组所有者到码头容器中的这个挂载点(/var/run/docker.sock)？

Answer 1

docker compose似乎很难做到这一点。可能适用于docker run用户的解决方法是从主机获取停靠组ID：

docker_group_id=$(getent group docker | cut -d: -f3)

然后添加参数以挂载/etc/passwd和/etc/group

  -u "$(id -u):$docker_group_id" \
  -v /etc/passwd:/etc/passwd \
  -v /etc/group:/etc/group \