Docker login before pulling image for GitLab Runner

user_1375292 0
Viewed 4608

I have set up a docker runner, where I want to run an image stored on a local repository. My /etc/gitlab-runner/config.toml is

concurrent = 1
check_interval = 0

[session_server]
  session_timeout = 1800


[[runners]]
  name = "Docker runner"
  url = "https://gitlab.str.corp/"
  token = "*secret*"
  executor = "docker"
  [runners.custom_build_dir]
  [runners.cache]
    [runners.cache.s3]
    [runners.cache.gcs]
    [runners.cache.azure]
  [runners.docker]
    tls_verify = false
    image = "gitlab.example.com:4443/docker:19.03.1-dind"
    privileged = true
    disable_entrypoint_overwrite = false
    oom_kill_disable = false
    disable_cache = false
    volumes = ["/certs/client", "/cache"]
    shm_size = 0

When I submit the job, it starts on the runner, but fails to pull the image:

Running with gitlab-runner 13.4.0 (4e1f20da)
  on Docker runner abcde123

Preparing the "docker" executor
Using Docker executor with image gitlab.example.com:4443/docker:19.03.8-git ...
Starting service gitlab.example.com/docker:19.03.1-dind ...
Authenticating with credentials from /root/.docker/config.json
Pulling docker image gitlab.example.com:4443/docker:19.03.1-dind ...
ERROR: Job failed: Error response from daemon: pull access denied for gitlab.example.com:4443/docker, repository does not exist or may require 'docker login': denied: requested access to the resource is denied (docker.go:142:0s)

The docker login is the problem. If I try to do docker pull <image> from the command line, I get the same error. A docker login then lets me pull the image.

I am pretty certain that I just need to do echo $CI_JOB_TOKEN | docker login -u gitlab-ci-token --password-stdin $CI_REGISTRY before pulling the image, but I don't know how to cause that to be run.

The docker image is stored in the gitlab integrated repository. This page makes it seem that the authentication should be automatically set up, but that is clearly not the case.

What do I need to do to be able to be able to pull the privately stored image.

gitlab gitlab-ci-runner docker
1 Answers

Since the runner pulls the image before any of the before_script, script, or after_script sections run, you won't be able to do a docker login... to make it work. You'll need to provide the Docker Auth config file so that the runner can log in.

The documentation for custom docker registries has all the info, but in short you can get the config from ~/.docker/config.json. If it doesn't use a credential store (like MacOS' keychain) you can copy the content directly and store it as a variable in your .gitlab-ci.yml file, or in your projects CI Variables named DOCKER_AUTH_CONFIG. If that variable is present, the runner will automatically use it to log into the registry and then pull the image.

There are other options for providing the variable as well as directions to follow if your docker installation uses a credential store in the docs above.

user_23078730
Related