CircleCI docker撰写权限被拒绝？

Question

我正在尝试在 circle ci 中使用 docker compose，以便我可以在工作流程中运行一些组件测试。但是当我尝试使用 docker compose 时，我得到了这个错误：Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.38/containers/json: dial unix /var/run/docker.sock: connect: permission denied/

这是我的圈子配置

version: 2
jobs:
  build:
  component_test:
    docker:
    - image: circleci/openjdk:8-jdk
    working_directory: ~/repo
    environment:
      JVM_OPTS: -Xmx3200m
      TERM: dumb
    steps:
    - checkout
    - run:
        name: Install Docker Compose
        command: |
          curl -L https://github.com/docker/compose/releases/download/1.19.0/docker-compose-`uname -s`-`uname -m` > ~/docker-compose
          chmod +x ~/docker-compose
          sudo mv ~/docker-compose /usr/local/bin/docker-compose
    - setup_remote_docker:
        docker_layer_caching: true
    - run: |
        set -x
        docker ps
        docker-compose up -d
    - run: |
        ./gradlew cucumber -Dtag="@Local"

输出： ====>> sudo groupadd docker #!/bin/bash -eo pipefail sudo groupadd docker ====>> sudo usermod -aG docker $USER #!/bin/bash -eo pipefail sudo usermod -aG docker $USER 用法：usermod [选项] LOGIN

Options:
  -c, --comment COMMENT         new value of the GECOS field
  -d, --home HOME_DIR           new home directory for the user account
  -e, --expiredate EXPIRE_DATE  set account expiration date to EXPIRE_DATE
  -f, --inactive INACTIVE       set password inactive after expiration
                                to INACTIVE
  -g, --gid GROUP               force use GROUP as new primary group
  -G, --groups GROUPS           new list of supplementary GROUPS
  -a, --append                  append the user to the supplemental GROUPS
                                mentioned by the -G option without removing
                                him/her from other groups
  -h, --help                    display this help message and exit
  -l, --login NEW_LOGIN         new value of the login name
  -L, --lock                    lock the user account
  -m, --move-home               move contents of the home directory to the
                                new location (use only with -d)
  -o, --non-unique              allow using duplicate (non-unique) UID
  -p, --password PASSWORD       use encrypted password for the new password
  -R, --root CHROOT_DIR         directory to chroot into
  -s, --shell SHELL             new login shell for the user account
  -u, --uid UID                 new UID for the user account
  -U, --unlock                  unlock the user account
  -v, --add-subuids FIRST-LAST  add range of subordinate uids
  -V, --del-subuids FIRST-LAST  remove range of subordinate uids
  -w, --add-subgids FIRST-LAST  add range of subordinate gids
  -W, --del-subgids FIRST-LAST  remove range of subordinate gids
  -Z, --selinux-user SEUSER     new SELinux user mapping for the user account

Error: Exited with code 2
Step failed
Error: runner failed
{"Runner":true,"level":"error","msg":"runner failed","task-id":"localbuild-1547728937","time":"2019-01-17T12:42:24Z"}
Task failed
Error: task failed

Answer 1

Docker 守护进程绑定到 Unix 套接字而不是 TCP 端口。默认情况下，Unix 套接字由用户 root 拥有，其他用户只能使用 sudo 访问它。 Docker 守护进程始终以 root 用户身份运行。如果您不想在 docker 命令前加上 sudo，请创建一个名为 docker 的 Unix 组并将用户添加到其中。当 Docker 守护进程启动时，它会创建一个可供 docker 组成员访问的 Unix 套接字。

创建docker 组并添加您的用户：

1. 创建docker 组。

$ sudo groupadd docker

1. 将您的用户添加到docker 组。

$ sudo usermod -aG docker $USER

1. 退出并重新登录，以便重新评估您的群组成员资格。

   如果在虚拟机上进行测试，可能需要重新启动虚拟机才能使更改生效。

   在 X Windows 等桌面 Linux 环境中，完全退出会话，然后重新登录。

2. 验证您是否可以在没有sudo 的情况下运行docker 命令。

$ docker ps