taylorsilva/dcind

Alpine image with Docker Compose. Useful as a base image for integration tests in Concourse

dcind (Docker-Compose-in-Docker) For Concourse

Alpine based image that lets you run Docker inside a Concourse task. Task must have privileged: true for Docker to start.

Release Pipeline

Usage

Use it in a task config:

image_resource:
  type: registry-image
  source:
    repository: taylorsilva/dcind

Pull it in as a resource to use as a task image:

resoures:
- name: dcind
  icon: docker
  type: registry-image
  source:
    repository: taylorsilva/dcind
    tag: latest

jobs:
...
  - get: dcind
  - task: doing-things
    image: dcind
    privileged: true

Run it locally on your machine:

$ docker run -it --privileged taylorsilva/dcind
Starting Docker...
waiting for docker to come up...
bash-5.1#

Tags

The Docker version is used to tag releases of the image. A new image is published everyday to ensure OS packages are up to date.

There are three kinds of tags being published, two rolling and one static.

Rolling Tags:

• latest: points to the latest image pushed which contains the latest versions of Docker and Docker-Compose
• DOCKER_VERSION: This tag is the docker version (e.g. 20.10.6) and is republished daily. Only the latest version of docker is republished. Older versions will become stale.

Static Tag:

• DOCKER_VERSION-YYYYmmdd: This tag is the docker version plus the date it was published. If you want to stay on a specific version of Docker + Docker-Compose then sticking to a particular daily build will meet your needs.

Example

Here is an example of a Concourse job that uses taylorsilva/dcind image to run a bunch of containers in a task, and then runs the integration test suite. You can find a full version of this example in the example directory.

Note that docker-lib.sh has bash dependencies, so it is important to use bash in your task.

- name: integration
  plan:
  - aggregate:
    - get: code
      params: {depth: 1}
      passed: [unit-tests]
      trigger: true
    - get: redis #a registry-image resource
      params:
        format: oci
    - get: busybox #a registry-image resource
      params:
        format: oci
  - task: Run integration tests
    privileged: true
    config:
      platform: linux
      image_resource:
        type: docker-image
        source:
          repository: amidos/dcind
      inputs:
      - name: code
      - name: redis
      - name: busybox
      run:
        path: bash
        args:
        - -cex
        - |
          source /docker-lib.sh
          start_docker

          # Strictly speaking, preloading of Docker images is not required.
          # However, you might want to do this for a couple of reasons:
          # - If the image comes from a private repository, it is much easier to let Concourse pull it,
          #   and then pass it through to the task.
          # - When the image is passed to the task, Concourse can often get the image from its cache.
          docker load -i redis/image
          docker tag "$(cat redis/image-id)" "$(cat redis/repository):$(cat redis/tag)"

          docker load -i busybox/image
          docker tag "$(cat busybox/image-id)" "$(cat busybox/repository):$(cat busybox/tag)"

          # This is just to visually check in the log that images have been loaded successfully
          docker images

          # Run the container with tests and its dependencies.
          docker-compose -f code/example/integration.yml run tests

          # Cleanup.
          # Not sure if this is required.
          # It's quite possible that Concourse is smart enough to clean up the Docker mess itself.
          docker volume rm $(docker volume ls -q)

dcind's Issues

Is there a build of this image anywhere?

It is great that there are newer branches of this docker-in-docker use case.

The readme shows a non working link to a build. Is this image built and available in a public registry? Or will users need to build from the repo and upload back to their own registry?

mount: /sys/fs/cgroup/cpuset: permission denied.

When trying to run it with concourse I get mount: /sys/fs/cgroup/cpuset: permission denied.
I have the privileged flag set so I'm not sure what is causing this. I'm running concourse itself with docker-compose so that's theoretically three layers of docker, don't know if this is relevant for my problem.

My task looks like this:

  - task: integration-test
    privileged: true
    #image: docker-compose
    config:
      image_resource:
        type: docker-image
        source:
          repository: taylorsilva/dcind
      inputs:
      - name: controller-code # we need that only for the compose file
      platform: linux
      run:
        path: bash
        args:
          - -exc
          - |
            source /docker-lib.sh
            start_docker

The full output is:

selected worker: 3a67589a1aec
+ source /docker-lib.sh
++ LOG_FILE=/tmp/docker.log
++ SKIP_PRIVILEGED=false
++ STARTUP_TIMEOUT=20
++ DOCKER_DATA_ROOT=/scratch/docker
+ start_docker
+ echo 'Starting Docker...'
Starting Docker...
+ '[' -f /tmp/docker.pid ']'
+ mkdir -p /var/log
+ mkdir -p /var/run
+ '[' false = false ']'
+ sanitize_cgroups
+ mkdir -p /sys/fs/cgroup
+ mountpoint -q /sys/fs/cgroup
+ mount -o remount,rw /sys/fs/cgroup
+ sed -e 1d /proc/cgroups
+ read sys hierarchy num enabled
+ '[' 1 '!=' 1 ']'
++ ++ cut -d: -f2
grep '\<cpuset\>'
++ cat /proc/self/cgroup
+ grouping=
+ true
+ '[' -z '' ']'
+ grouping=cpuset
+ mountpoint=/sys/fs/cgroup/cpuset
+ mkdir -p /sys/fs/cgroup/cpuset
+ mountpoint -q /sys/fs/cgroup/cpuset
+ mount -n -t cgroup -o cpuset cgroup /sys/fs/cgroup/cpuset
mount: /sys/fs/cgroup/cpuset: permission denied.

Thank you for your help

Binary installation of docker-compose fails

I tried to have the image do a binary installation of docker-compose, following https://github.com/docker/docker.github.io/blob/master/compose/install.md#install-compose-on-linux-systems

but trying to run docker-compose kept failing with

bash-5.1# docker-compose
bash: /usr/local/bin/docker-compose: No such file or directory

Doing ls -l on /usr/local/bin/docker-compose showed that the file does exist though. The images PATH also contains /usr/local/bin. I'm not sure what it's referring to when it says No such file or directory.

So I reverted back to using pip to install. Using pip adds a lot of time (~6mins) to the build because of this "wheel building" step:

#6 59.43 Building wheels for collected packages: bcrypt, cryptography, pynacl, PyYAML
#6 59.44   Building wheel for bcrypt (PEP 517): started
#6 61.90   Building wheel for bcrypt (PEP 517): finished with status 'done'
#6 61.90   Created wheel for bcrypt: filename=bcrypt-3.2.0-cp38-cp38-linux_x86_64.whl size=64444 sha256=c1d6a2ebbe1e35e774b8dc500c68563a721de4f554ddb5f5fd40d387d21faa76
#6 61.90   Stored in directory: /root/.cache/pip/wheels/af/42/cb/78425eb7d565a75b710a82f213c19f7100b873af40ddb372fc
#6 61.91   Building wheel for cryptography (PEP 517): started
#6 125.5   Building wheel for cryptography (PEP 517): still running...

It would be nice to get the binary installation working and have the build time take <1min.