Latest dind uses TLS by default (great) which is imposible to configure clients that don't run as root

[rlees85]

Its great that dockerd is now configured for TLS by default with the required certificates generated automatically.

Unfortunately, I have tried to configure this in our Jenkins environment and found it impossible to make any use of.

I have two containers running in a pod. One, is "dind" and the other is Jenkins JNLP.

A volume is shared between the containers /certs/client. dind runs as root (I assume it must, I did not configure this specifically) and generates certificates as root. The private key gets mode 600.

The client runs as jenkins (UID 10000).

I have tried configuring the fsGroup in the Kubernetes spec but as the mode is 600 and not something else like 640 it is impossible for the Jenkins JNLP docker client to speak to dind using TLS.

I would suggest making everything generated by dockerd mode 640 as the default group is root anyway.

[jtszalay]

This has broken the pipelines at my place of employment overnight.

https://gitlab.com/gitlab-org/gitlab-runner/issues/4501

[tianon]

I agree and thought that'd been covered, apologies! I'd argue the generated client certificates should go even as wide as 0644 to ensure their maximum usefulness.

[tianon]

I swore I'd tested this 😅 -- I can't reproduce the issue for anything except key.pem (everything else is already 0644):

$ docker pull docker:19.03-dind
19.03-dind: Pulling from library/docker
Digest: sha256:489583792626bc5ffd20dd739c0189ecb0267ab2fecf7e5b855c449eb50e1d76
Status: Image is up to date for docker:19.03-dind

$ docker run -d --name dind --privileged docker:19.03-dind
66b90ac9b856f673221f5b55ee1200f8f72b22a8c7fd31a8de8c5315736d248e

$ docker exec dind ls -l /certs/client
total 20
-rw-r--r--    1 root     root          1854 Jul 23 17:17 ca.pem
-rw-r--r--    1 root     root          1777 Jul 23 17:17 cert.pem
-rw-r--r--    1 root     root          1630 Jul 23 17:17 csr.pem
-rw-------    1 root     root          3321 Jul 23 17:17 key.pem
-rw-r--r--    1 root     root            44 Jul 23 17:17 openssl.cnf