<p>I'm trying to build a docker image using DIND with Atlassian Bamboo.</p>

<p>I've created the deployment/ StatefulSet as follows:</p>

<pre><code>---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  labels:
    app: bamboo
  name: bamboo
  namespace: csf
spec:
  replicas: 1
  serviceName: bamboo
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: bamboo
  template:
    metadata:
      creationTimestamp: null
      labels:
        app: bamboo
    spec:
      containers:
      - image: atlassian/bamboo-server:latest
        imagePullPolicy: IfNotPresent
        name: bamboo-server
        resources: {}
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        securityContext:
          privileged: true
        volumeMounts:
        - name: bamboo-home
          mountPath: /var/atlassian/application-data/bamboo
        - mountPath: /opt/atlassian/bamboo/conf/server.xml
          name: bamboo-server-xml
          subPath: bamboo-server.xml
        - mountPath: /var/run 
          name: docker-sock
      volumes:
      - name: bamboo-home
        persistentVolumeClaim:
          claimName: bamboo-home
      - configMap:
          defaultMode: 511
          name: bamboo-server-xml
        name: bamboo-server-xml
      - name: docker-sock 
        hostPath: 
          path: /var/run
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      securityContext: {}
      terminationGracePeriodSeconds: 30
</code></pre>

<p>Note that I've set <code>privileged: true</code> in <code>securityContext</code> to enable this.</p>

<p>However, when trying to run docker images, I get a permission error:</p>

<pre><code>Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Post http://%2Fvar%2Frun%2Fdocker.sock/v1.40/containers/create: dial unix /var/run/docker.sock: connect: permission denied.
See '/var/atlassian/application-data/bamboo/appexecs/docker run --help'
</code></pre>

<p>Am I missing something wrt setting up DIND?</p>

bear
<p>The /var/run/docker.sock file on the host system is owned by a different user than the user that is running the bamboo-server container process.</p>

<p>Without knowing any details about your cluster, I would assume docker runs as 'root' (UID=0). The bamboo-server runs as 'bamboo', as can be seen from its <a href="https://bitbucket.org/atlassian-docker/docker-bamboo-server/src/def31993078d9d06dedf36b6bdc6f4e33f4a5232/Dockerfile#lines-55" rel="nofollow noreferrer">Dockerfile</a>, which will normally map to a UID in the 1XXX range on the host system. As these users are different and the container process did not receive any specific permissions over the (host) socket, the error is given.</p>

<p>So I think there are two approaches possible:</p>

<ul>
<li><p>Or the container process continues to run as the 'bamboo' user, but is given sufficient permissions on the host system to access /var/run/docker.sock. This would normally mean adding the UID the bamboo user maps to on the host system to the docker group on the host system. However, making changes to the host system might or might not be an option depending on the context of your cluster, and is tricky in a cluster context because the pod could migrate to a different node where the changes were not applied and/or the UID changes.</p></li>
<li><p>Or the container is changed as to run as a sufficiently privileged user to begin with, being the root user. There are two ways to accomplish this: 1. you extend and customize the Atlassian provided base image to change the user or 2. you override the user the container runs as at run-time by means of the 'runAsUser' and 'runAsGroup' securityContext instructions as specified <a href="https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod" rel="nofollow noreferrer">here</a>. Both should be '0'.</p></li>
</ul>
