Jenkins docker permission

Question

On a Ubuntu server, I'm running jenkins docker container. For testing purpose, in my jenkinsfile of my project, I must run a postgres server. I'm trying to build a container postegres docker in my steps.

However, I can't do it, I get permission errors :

Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.26/containers/json?filters=%7B%22name%22%3A%7B%22vpx_postgres%22%3Atrue%7D%7D: dial unix /var/run/docker.sock: connect: permission denied

Here my jenkins file below. The stage "Database creation" is failling.

def message = "";
def author = "";

def getLastCommitMessage = {
    message = sh(returnStdout: true, script: 'git log -1 --pretty=%B').trim()
}

def getGitAuthor = {
    def commit = sh(returnStdout: true, script: 'git rev-parse HEAD')
    author = sh(returnStdout: true, script: "git --no-pager show -s --format='%an' ${commit}").trim()
}

pipeline {
    agent {
        docker { image 'starefossen/ruby-node' }
    }
    stages {
       stage('Database creation') {
                    steps {
                        sh 'docker ps -f name=project_postgres -q | xargs --no-run-if-empty docker container stop'
                        sh 'docker container ls -a -fname=project_postgres -q | xargs -r docker container rm'
                        sh 'docker pull postgres'
                        sh 'docker run --name project_postgres -e POSTGRES_PASSWORD=secret -e POSTGRES_USER=postgres -p 5432:5432 -d postgres'
                    }
        }
        stage('Test') {
            steps {
                script {
                  getLastCommitMessage()
                  getGitAuthor()
                }
                sh 'RAILS_ENV=test bundle install --jobs 3'
                sh 'RAILS_ENV=test yarn install'
                sh 'RAILS_ENV=test bundle exec rails db:migrate'
                sh 'RAILS_ENV=test bundle exec rspec -f documentation'
            }
        }
    }
    post {
        failure {
          rocketSend channel: 'project-x-ci', emoji: ':x:', message: "Build failed - Commit : '${message}' by ${author}", rawMessage: true
        }
    }
}

Maybe the issue is from the jenkins docker ? Here the docker-compose.yml :

version: '2'

services:
  jenkins-server:
    build: ./ 
    ports:
      - 8080:8080
      - 50000:50000
    volumes:
      - /home/xero/jenkins/jenkins_home:/var/jenkins_home
      - /var/run/docker.sock:/var/run/docker.sock
      - /usr/bin/docker:/usr/bin/docker
    environment:
      JENKINS_USER: jenkins
      JENKINS_URL: "http://10.0.1.66:8080/"
      DOCKER_SOCKET: /var/run/docker.sock
      DOCKER_GROUP: dockerhost
      DOCKER_HOST: unix:///var/run/docker.sock
    restart: always
    dns:
      - 10.0.1.1

Dockerfile :

FROM jenkinsci/jenkins:latest
USER root

COPY ["entrypoint.sh", "/"]

RUN apt-get update && \
    apt-get install sudo && \
    chmod 755 /entrypoint.sh

ENTRYPOINT ["/bin/bash","-c","./entrypoint.sh"]

And my entrypoint.sh :

#!/bin/bash

if [ -S ${DOCKER_SOCKET} ]; then
    DOCKER_GID=$(stat -c '%g' ${DOCKER_SOCKET})
    groupadd -for -g ${DOCKER_GID} ${DOCKER_GROUP}
    usermod -aG ${DOCKER_GROUP} ${JENKINS_USER}
fi

exec sudo -E -H -u jenkins bash -c /usr/local/bin/jenkins.sh

IMPORTANT :

HOST(ubuntu) -> JENKINS(docker) -> POSTGRES(docker)

In my jenkins docker container, docker is available, I have no problem. The issue is when I build a project in jenkins from an jenkinsfile.

So the JENKINS container, cannot create other container (here, the POSTGRES container)

Yogesh_D Yogesh_D · Accepted Answer · 2018-04-10T09:38:49

Figure out the user that is used to run jenkins and add that user to the docker group.

This should take care of the permissions issue.

You can add a user to the docker group using sudo usermod -aG docker <jenkins-user-name>.

Info of why this is needed:

The docker daemon binds to a Unix socket instead of a TCP port. By default that Unix socket is owned by the user root and other users can only access it using sudo. The docker daemon always runs as the root user.

If you don’t want to use sudo when you use the docker command, create a Unix group called docker and add users to it. When the docker daemon starts, it makes the ownership of the Unix socket read/writable by the docker group.

Jenkins docker permission

1 Answers