How to run docker containers in Kubernetes mode?

[mrclrchtr]

This is my config:

runnerScaleSetName: k8s-runner
template:
  spec:
    imagePullSecrets:
      - name: gha-runner-scale-set-dockerconfigjson
    securityContext:
      fsGroup: 1001
    containers:
      - name: runner
        image: ghcr.io/actions/actions-runner:latest
        command:
          - /home/runner/run.sh
        env:
          - name: ACTIONS_RUNNER_CONTAINER_HOOKS
            value: /home/runner/k8s/index.js
          - name: ACTIONS_RUNNER_POD_NAME
            valueFrom:
              fieldRef:
                fieldPath: metadata.name
          - name: ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER
            value: 'false'
        volumeMounts:
          - mountPath: /home/runner/_work
            name: work
    restartPolicy: Never
    volumes:
      - ephemeral:
          volumeClaimTemplate:
            spec:
              accessModes:
                - ReadWriteOnce
              resources:
                requests:
                  storage: 3Gi
              storageClassName: longhorn
        name: work
    serviceAccountName: k8s-runner-gha-rs-kube-mode
controllerServiceAccount:
  namespace: gha-runner-scale-set-controller
  name: controller

Job-Error:

Cannot connect to the Docker daemon at tcp://localhost:2375. Is the docker daemon running?

I currently have no idea, how I can run containers in this setup. I tried to add a dind sidecar, but then it not even start the runner..

[ismoiliy98]

You should run DinD mode in order to use docker, or you can use docker alternatives if you want to build images, e.g., Kaniko

[raine-works]

I got it to work by giving the runner permission to access the host docker daemon. Sorry if my yaml is messed up. I converted it from typescript as I am using pulumi.

containerMode:
  type: kubernetes
  kubernetesModeWorkVolumeClaim: 
    accessMode: ["ReadWriteOnce"]
    storageClaimClass: longhorn
    resources:
      requests: 
        storage: 3Gi
template:
  spec:
    securityContext:
      fsGroup: 1001
    initContainers:
      - name: docker-setup
        image: busybox:1.35
        command: ["sh", "-c", "chmod 666 /var/run/docker.sock"
        volumeMounts:
          - name: docker-socket
            mountPath: /var/run/docker.sock
    containers:
      - name: runner
        image: ghcr.io/actions/actions-runner:2.317.0
        command: ["/home/runner/run.sh"]
        env:
          - name: ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER
            value: "false"
        securityContext:
          privileged: true
        volumeMounts:
          - name: docker-socket
            mountPath: /var/run/docker.sock
    volumes:
      - name: docker-socket
        hostPath:
          path: /var/run/docker.sock

[galshmilo]

Which benefits do you get from implementing this?
As you already basically let it run in privileged mode, why not just going with DinD out-of-the-box mode?