# Creating Docker Images Inside Kubernetes Act Runner?

**URL:** <https://forum.gitea.com/t/creating-docker-images-inside-kubernetes-act-runner/10062>\
**Category:** Install/Maintain/Configure\
**Created:** [November 18, 2024, 6:17am UTC](https://forum.gitea.com/t/creating-docker-images-inside-kubernetes-act-runner/10062 "2024-11-18T06:17:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![eddieparker](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/eddieparker/32/6417_2.png) [@eddieparker](https://forum.gitea.com/u/eddieparker)\
**Post date:** [November 18, 2024, 6:17am UTC](https://forum.gitea.com/t/creating-docker-images-inside-kubernetes-act-runner/10062/1 "2024-11-18T06:17:19Z")

</div>

Pardon me if this is known, but I couldn’t find any good documentation on what I’m seeing here.

I’m trying to build docker images inside of an act runner that I have running as a stateful-set of pods running inside a kubernetes cluster.

Various things I’ve tried have all yielded in effectively a failure to talk to docker, i.e:

> Cannot connect to the Docker daemon at tcp://localhost:2375. Is the docker daemon running?

My workflow at present is as such:

```auto
name: Deploy to production

on:
  push:
    branches:
      - main

jobs:
  build:
    runs-on: ubuntu-latest

    container:
      image: catthehacker/ubuntu:act-latest
      env:
        DOCKER_HOST: tcp://localhost:2375

      ports:
        - 2375

      volumes:
        - /var/run/docker.sock:/var/run/docker.sock
        - /certs

    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Run docker compose build
        run: docker compose -f docker/webserver/docker-compose.yml build

```

And the act runner I’m using looks like this:

```auto

apiVersion: v1
kind: Pod
metadata:
  labels:
    app: act-runner
    apps.kubernetes.io/pod-index: "0"
    statefulset.kubernetes.io/pod-name: act-runner-0
  name: act-runner-0
  namespace: gitea
spec:
  containers:
  - env:
    - name: DOCKER_HOST
      value: tcp://localhost:2376
    - name: DOCKER_CERT_PATH
      value: /certs/client
    - name: DOCKER_TLS_VERIFY
      value: "1"
    - name: GITEA __log__ LEVEL
      value: debug
    - name: GITEA_INSTANCE_URL
      value: https://example.com
    - name: GITEA_RUNNER_REGISTRATION_TOKEN
      value: supersecrettoken
    - name: GITEA_RUNNER_NAME
      valueFrom:
        fieldRef:
          apiVersion: v1
          fieldPath: metadata.name
            path: namespace

```

If there’s anything obvious I’m missing, please let me know; would be nice to get this figured out.

---

<div class="post-metadata">

**Author:** ![eddieparker](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/eddieparker/32/6417_2.png) [@eddieparker](https://forum.gitea.com/u/eddieparker)\
**Post date:** [November 18, 2024, 6:51am UTC](https://forum.gitea.com/t/creating-docker-images-inside-kubernetes-act-runner/10062/2 "2024-11-18T06:51:49Z")

</div>

Of course. Now that I step away, I made another step.

If anyone else is curious, what I did, was keep most of the above the same, except:

- I found out that my dind-rootless created a docker.sock under /run/user/1000/docker.sock
- Found out that there’s a valid\_volumes setting in the config that lets you allow certain regexes/volumes to be mounted.

I also took the opportunity to turn debug logging onto high for the gitea runner (in the configmap) and it made things more apparent.

I’m not quite running but docker isn’t squealing anymore.

---

<div class="post-metadata">

**Author:** ![phkrl](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.gitea.com/phkrl/32/6028_2.png) [@phkrl](https://forum.gitea.com/u/phkrl)\
**Post date:** [November 18, 2024, 9:02am UTC](https://forum.gitea.com/t/creating-docker-images-inside-kubernetes-act-runner/10062/3 "2024-11-18T09:02:33Z")

</div>

If you want to have docker-in-docker, you have two options. First is to run separate container with running docker daemon in it linked to you job as service (see actions services syntax for details). IIRC this container must be privileged. In order to use dind that way, docker daemon must listen on some tcp port and you need to set DOCKER\_HOST to docker container name (not localhost since it will be treated as same container where client is run).  
Second option is to pass docker socket from host to act\_runner container (it should be noted in its manifest) and then into job. Insecure, if you care.  
Finally, docker images can be built by other engines like podman (buildah) or kaniko. Those don’t need any socket access but still require some capabilities to be set on container running them.