Skip to content

Fix regression in handling Docker Machine credentials with docker+machine executor

What does this MR do?

Fixes regression introduced with !559 (merged)

Why was this MR needed?

When using docker+machine executor, Runner is first creating (or looking for a free) machine and then fills DockerCredentials of Runner's configuration copy with credentials of the machine. Thanks to this we can execute Docker commands on the remote machine from Runner, having still general Docker configuration from config.toml file.

!559 (merged) introduced a regression where these credentials are not set. Because of this Runner started to behave strange.

If there would be no Docker Engine installed on Runner's host then the job would fail with an error saying that docker daemon was not available (DockerCredentials.Host is empty so used Docker client library will try to connect to the default endpoint on a local host).

If Runner's host has Docker Engine installed, then after a machine is created all docker commands are still executed against the local Docker Engine. This means that:

  • one host needs to handle all jobs load,
  • different jobs are interrupting themselves, destroying containers or creating containers with the same name on the same host,
  • in case when MaxBuilds is set to 0 due to security reasons (e.g. don't allow users re-use machines where Docker is running in privileged mode) this may introduce security issues.

The problem was discovered after we've upgraded our private runners to v9.2.0-rc.2.

Are there points in the code the reviewer needs to double check?

Does this MR meet the acceptance criteria?

  • Documentation created/updated
  • Tests
    • Added for this feature/bug
    • All builds are passing
  • Branch has no merge conflicts with master (if you do - rebase it please)

What are the relevant issue numbers?

Merge request reports

Loading