Docker DIND無法訪問私有注冊表

Question

我正在使用GitLab以及GitLab運行程序和DIND。

配置詳細信息：

---------------------------------------

docker run --privileged --name gitlab-dind -d --restart=always docker:17.07-dind

---------------------------------------

cat gitlab_runner.sh
docker run -d --name gitlab-runner --restart always \
  -v /mnt/data/gitlab/gitlab-runner:/etc/gitlab-runner \
  --link gitlab-dind:docker \
  gitlab/gitlab-runner:v9.5.0

---------------------------------------

cat /mnt/data/gitlab/gitlab-runner/config.toml
concurrent = 1
check_interval = 0

[[runners]]
  name = "RunnerA"
  url = "https://gitlab.dev.abc.net"
  token = "d8ed43a69ebed74ccab2493857d8cb"
  executor = "docker"
  [runners.docker]
    tls_verify = false
    image = "docker:17.07"
    privileged = false
    disable_cache = false
    volumes = ["/cache"]
    host = "tcp://gitlab-dind:2375"
    shm_size = 0
  [runners.cache]

---------------------------------------

cat ~/wksp/test-proj/.gitlab-ci.yml
image: docker.artifactory.abc.net/docker:17.07

variables:
  DOCKER_HOST: tcp://docker:2375

# This before_script block was added later but it seems this block
# isn't executed before the DIND tries fetching image from Artifactory
before_script:
  - docker login -u svc-art-user -p some-pwd docker.artifactory.abc.net
  - docker info

services:
- docker.artifactory.abc.net/docker:17.07-dind

build:
  stage: build
  script:
  - docker build -t my-docker-node-image .

---------------------------------------

順便說一句，在上述結構中， DOCKER_HOST配置需要.gitlab-ci.yml或只是入門（ host = "tcp://gitlab-dind:2375 ）在config.toml足夠？

現在，當跑步者跑步時，出現以下錯誤：

Runner log error:
Running with gitlab-ci-multi-runner 9.5.0 (413da38)
  on RunnerA (d8ed43a6)
Using Docker executor with image docker.artifactory.abc.net/docker:17.07 ...
Starting service docker.artifactory.abc.net/docker:17.07-dind ...
Pulling docker image docker.artifactory.abc.net/docker:17.07-dind ...
ERROR: Preparation failed: Error response from daemon: Get https://docker.artifactory.abc.net/v2/: x509: certificate signed by unknown authority

我可能是錯的，但似乎出現此錯誤是因為服務帳戶 （ svc-art-user ）在DIND映像提取發生之前無法登錄。

Answer 1

您需要向Gitlab Runner提供身份驗證詳細信息，因為它需要提取圖像。

您需要使用以下身份驗證詳細信息創建DOCKER_AUTH_CONFIG秘密變量

{
     "auths": {
         "docker.artifactory.abc.net": {
             "auth": "bXlfdXNlcm5hbWU6bXlfcGFzc3dvcmQ="
         }
     }
 }

您可以通過本地登錄~/.docker/config.json並檢查~/.docker/config.json

該文檔提供了有關此內容的詳細信息

https://docs.gitlab.com/ce/ci/docker/using_docker_images.html#define-an-image-from-a-private-docker-registry

https://docs.gitlab.com/runner/configuration/advanced-configuration.html#using-a-private-container-registry