Cannot connect to docker sock in K8S with DIND sidecar

[ccincotti3]

Hi y'all,

This is my first time setting up self hosted runners. I've been trying to run docker and build an image to push to ECR using GitHub actions, the ARC, and Kubernetes. I've done quite a bit of searching guides, docs here, etc... I keep receiving:

I've exec'd into the main runner pod and I can connect OK via the command docker ps. I believe this to be the case as it seems that volume with the dind sock is mounted to this pod. However, when the workflow pods are kicked off, I believe these pods do not have access to the side car, as I do not see that the dind volume is being mounted to those pods. Does this make sense? Is there a configuration that I'm missing?
 
Here's my Helm chart, it seems pretty basic:

template:
  spec:
    affinity:
      nodeAffinity:
        requiredDuringSchedulingIgnoredDuringExecution:
          nodeSelectorTerms:
            - matchExpressions:
                - key: beta.kubernetes.io/instance-type
                  operator: In
                  values:
                  - t3.large
    serviceAccountName: test-runner-sa
    initContainers:
      - name: init-dind-externals
        image: ghcr.io/actions/actions-runner:latest
        command: ["cp", "-r", "-v", "/home/runner/externals/.", "/home/runner/tmpDir/"]
        volumeMounts:
          - name: dind-externals
            mountPath: /home/runner/tmpDir
    containers:
      - name: runner
        image: ghcr.io/actions/actions-runner:latest
        command: ["/home/runner/run.sh"]
        resources:
          requests:
            cpu: 100m
            memory: 3Gi
        env:
          - name: DOCKER_HOST
            value: "unix:///var/run/docker.sock"
          - name: ACTIONS_RUNNER_CONTAINER_HOOKS
            value: /home/runner/k8s/index.js
          - name: RUNNER_WAIT_FOR_DOCKER_IN_SECONDS
            value: "120"
          - name: ACTIONS_RUNNER_POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER
            value: "true"
        volumeMounts:
          - name: work
            mountPath: /home/runner/_work
          - name: dind-sock
            mountPath: /var/run
            readOnly: true
      - name: dind
        image: docker:dind
        args:
          - dockerd
          - --host=unix:///var/run/docker.sock
          - --group=$(DOCKER_GROUP_GID)
        env:
          - name: DOCKER_GROUP_GID
            value: "123"
        securityContext:
          privileged: true
        dockerVolumeMounts:
          - mountPath: /var/lib/docker
            name: docker
            subPathExpr: $(POD_NAME)-docker
          - mountPath: /runner/_work
            name: work
            subPathExpr: $(POD_NAME)-work
        volumeMounts:
          - name: work
            mountPath: /home/runner/_work
          - name: dind-sock
            mountPath: /var/run
          - name: dind-externals
            mountPath: /home/runner/externals
    tolerations:
      - key: reserved
        operator: Equal
        value: test-small-runner
        effect: NoSchedule
    volumes:
      - name: dind-sock
        emptyDir:
          medium: Memory
      - name: dind-externals
        emptyDir:
          medium: Memory
      - name: work
        ephemeral:
          volumeClaimTemplate:
            spec:
              accessModes: ["ReadWriteOnce"]
              storageClassName: gp2
              resources:
                requests:
                  storage: 5Gi
    securityContext:
      fsGroup: 1001

[ccincotti3]

Ah OK of course -- I may need to instead use a shared volume between the pods, since the worker that gets spun up needs docker as well. Let me rethink this.

[umaasik]

Did you come up with a solution to this?