<p>I'm trying to host a Jenkins image on GKE to run a build. Mostly, I've followed <a href="https://cloud.google.com/solutions/jenkins-on-kubernetes-engine-tutorial" rel="noreferrer">Google's tutorial for setting up Jenkins in Kubernetes</a>. I've got a fairly basic set-up with one master node which runs the builds.</p>

<p>I also want to be able to use Docker inside of the Jenkins environment, and so I've gone into Jenkins' Global Tools Configuration and added a Docker instance. I've additionally mapped the docker.sock in my deployment file to bypass a "Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?" problem.</p>

<p>My current deployment looks like this:</p>

<pre><code>apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: jenkins
  namespace: jenkins
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: master
    spec:
      containers:
      - name: master
        image: jenkins/jenkins:2.95
        ports:
        - containerPort: 8080
        - containerPort: 50000
        readinessProbe:
          httpGet:
            path: /login
            port: 8080
          periodSeconds: 10
          timeoutSeconds: 5
          successThreshold: 2
          failureThreshold: 5
        env:
        - name: JENKINS_OPTS
          valueFrom:
            secretKeyRef:
              name: jenkins
              key: options
        - name: JAVA_OPTS
          value: '-Xmx1400m'
        volumeMounts:
        - mountPath: /var/jenkins_home
          name: jenkins-home
        - mountPath: /var/run/docker.sock
          name: docker-socket
        securityContext:
          privileged: true
        resources:
          limits:
            cpu: 500m
            memory: 1500Mi
          requests:
            cpu: 500m
            memory: 1500Mi
      volumes:
      - name: jenkins-home
        gcePersistentDisk:
          pdName: jenkins-home
          fsType: ext4
          partition: 1
      - name: docker-socket
        hostPath:
          path: /var/run/docker.sock
</code></pre>

<p>Unfortunately, any builds fail with the following error:</p>

<pre><code>Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: 
....
dial unix /var/run/docker.sock: connect: permission denied
</code></pre>

<p>Most Google searches involving this error seem don't seem to be Kubernetes-related. </p>

<p>What am I missing?</p>

<p><strong>Update:</strong> To some extent, this works better if I use this configuration:</p>

<pre><code>spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: master
    spec:
      securityContext:
        runAsUser: 0
      containers:
</code></pre>

<p>which basically runs Jenkins as root. Unfortunately, that has some consequences for the way that pipelines manage auth credentials. When I try to use "withRepository(repoName, credentialId)", the pipeline adds an entry to <code>/var/jenkins_home/.dockercfg</code>, but a later docker push step doesn't seem to be able to find those credentials (I think that later step ends up looking in <code>/root/.dockercfg</code> or <code>/root/.docker/config.json</code>). </p>

<p>You might want to try running it as the <code>1000</code> user:</p>

<pre><code>...
spec:
  ...
  securityContext:
    # Specify fsGroup for pod, so that the persistent volume is writable for the non-privileged uid/gid 1000
    runAsUser: 1000
    fsGroup: 1000
  ...
</code></pre>

<p>You may also find <a href="https://github.com/kubernetes/charts/blob/master/stable/jenkins/templates/jenkins-master-deployment.yaml" rel="nofollow noreferrer">this Helm chart</a> useful.</p>
