Docker Image Builder in ADO pipeline

Question

I am Trying to build the container image through ADO pipeline and docker Task , While running Bash@3 Task getting Bash Error , that I added below. and if I skip the Bash@3 task getting another error with docker@3 task that I added below . Could some one help to fix this and agent is running on AKS pods based agent.

 - task: DockerInstaller@0
 inputs:
 dockerVersion: '27.2.1'
 - task: Bash@3
 displayName: 'sudo status check'
 inputs:
 targetType: 'inline'
 script: | 
 docker --version
 sudo systemctl restart docker 
 - task: Docker@2
 displayName: Build and publish image to Azure Container Registry
 inputs:
 command: 'buildAndPush'
 containerRegistry: $(dockerRegistryServiceConnection)
 repository: $(imageRepository)
 dockerfile: $(dockerfilePath)
 tags: |
 $(tag)
 latest

Bash Error

sudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper
sudo: a password is required
sudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper
sudo: a password is required

Docker@3 error

Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
/azp/_work/_tool/docker-stable/27.2.1/x64/docker pull ubuntu:22.04
/azp/_work/_tool/docker-stable/27.2.1/x64/docker inspect ubuntu:22.04
[]
DEPRECATED: The legacy builder is deprecated and will be removed in a future release.
 Install the buildx component to build images with BuildKit:
 https://docs.docker.com/go/buildx/
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
##[error]DEPRECATED: The legacy builder is deprecated and will be removed in a future release.
##[error] Install the buildx component to build images with BuildKit:
##[error] https://docs.docker.com/go/buildx/
##[error]Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
##[error]The process '/azp/_work/_tool/docker-stable/27.2.1/x64/docker' failed with exit code 1

• wenbo - Finding Job: Your pod based agent seems need docker daemon pre-installed if using Docker@2, and for bash@3 have you tried to remove sudo ?
• Alvin Zhao: Hi @pks, Have you got a chance to check my answer to use a container agent that bind-mounts the Docker socket in order to use Docker in Docker container? Hope the information may help resolve the issue in your post. Thx.
• pks: yes @AlvinZhao-MSFT thanks

Answer 1

I could reproduce the issue when the pipeline was running on a container agent.

docker

Please note that,

In order to use Docker from within a Docker container, you bind-mount the Docker socket.

Doing this has serious security implications. The code inside the container can now run as root on your Docker host.

Docker was replaced with containerd in Kubernetes 1.19, and Docker-in-Docker became unavailable.

If you're sure you want to proceed with this approach, you can start the container agent using the following command that bind-mounts the Docker socket, as you can see in my second attempt, the pipeline run was succeeded.

docker run -d \
 -e AZP_URL="https://dev.azure.com/xxxYourADOOrgNamexxx/" \
 -e AZP_TOKEN="$PAT" \
 -e AZP_POOL="xxxDockerPool" \
 -e AZP_AGENT_NAME="xxx-DockerAgent" \
 --name "azp-agent-linux" \
 -v /var/run/docker.sock:/var/run/docker.sock \
 azp-agent:linux

Before proceeding, consider whether it is necessary to build a Docker image on a container agent. There are other safer and more scalable options, such as, Microsoft-hosted, self-hosted, VMSS and MDP agents.