Run service in privileged container

We need to run service in privileged container (we want to use image gentics/tmpfs-mysql for our integration tests).

Also other options to configure services similarly to runner container can be useful (mount volumes).

What should we add? Can you propose implementation?

Proposed changes:

a) use privileged config value of runner.docker also for services

b) add new config value privileged_sevices which will define what services can run as privileged

privileged_services = ["*", "*/*"]

c) add config for services. I'm not sure how exactly this can be implemented.

Maybe new config section in config.toml:

[[runners]]
  url = "..."
  token = "..."
  name = "..."
  executor = "docker"
  [runners.docker]
    image = "..."
    privileged = true
    volumes = ["/workspace/composer-cache:/root/.composer/cache"]
    allowed_images = ["*", "*/*", "*/*/*"]
    allowed_services = ["*", "*/*"]

[[services]]
  [services.mysql/*]
    privileged = true
    volumes = ["/ramdisk:/var/lib/mysql"]

I would prefer to set privileged option on the .gitlabci.yml instead of runner configuration for a more generic way.

For my personal use case, I have a docker-compose configuration that I want to run on gitlab-ci.

For this, I have to use docker image and privileged service: https://hub.docker.com/_/docker/

Here is my configuration file:

image: soullivaneuh/docker-bash

services:
  - docker:dind

before_script:
  - apk add --update bash py-pip
  - pip install docker-compose
  - ./configure
  - docker-compose up -d

lint:
  script:
    - npm install --no-spin
    - composer install ${COMPOSER_FLAGS}
    - coffeelint web/assets/js/
    - ./app/console lint:yaml app --verbose
    - ./app/console lint:yaml src --verbose
    - phplint 'src/**/*.php' 'app/**/*.php' '!app/cache/**' --suppress
    - php-cs-fixer fix --verbose --dry-run

test:
  script:
    - ./docker-console npm install --no-spin
    - ./docker-console bower update --allow-root
    - ./docker-console composer install ${COMPOSER_FLAGS}
    - ./docker-console app/console fos:js-routing:dump
    - ./docker-console app/console assetic:dump
    - ./docker-console make test

Please note that the soullivaneuh/docker-bash image is just a docker image with bash installed.

The problem is I can't run it with privileges, so I get this error:

*** WARNING: Service runner-1ee5079f-project-3-concurrent-1-docker probably didn't start properly.

API error (500): Cannot start container 2a60e02b5c44fe35f0b27872a28d8818de2ba676568392085b73cc5b92502f17: Cannot link to a non running container: /runner-1ee5079f-project-3-concurrent-1-docker AS /runner-1ee5079f-project-3-concurrent-1-docker-wait-for-service/runner-1ee5079f-project-3-concurrent-1-docker

2016-01-04T13:04:14.386567235Z mount: permission denied (are you root?)
2016-01-04T13:04:14.386752829Z Could not mount /sys/kernel/security.
2016-01-04T13:04:14.386770249Z AppArmor detection and --privileged mode might break.
2016-01-04T13:04:14.388245310Z mount: permission denied (are you root?)

*********

Milestone changed to v1.2

Added improvement label

Milestone changed to v1.3

Milestone changed to %Backlog

I just was going to open an issue and think what @MartinMystikJonas did suggest sounds good. My main use case is building docker and testing docker images, I now use the solution with the privileged option as outlined here: https://gitlab.com/help/ci/docker/using_docker_build.md, but feel uncomfortable. Using a pattern for this would definitely be something good IMO, so at least b) would be great.