Unable to set DOCKER_HOST and DOCKER_TLS_VERIFY properties with docker toolchain

[bajacondor]

rules_docker with the docker toolchain appears unable to connect to a remote docker daemon Setting a custom config seems to have no effect for these properties.

[nlopezgi]

hi @bajacondor,
I don't think we have implemented features to connect to a remote docker deamon (to be honest I'm not familiar atm with use of these env vars). We would be happy to work with you if you want to contribute this feature.

[bajacondor]

Hi @nlopezgi, Thanks for your reply. I was able to hack the toolchain_configure rules docker_path argument, and I set all the remote host and tls values as flags to the docker command. This worked up until install_pkgs() specifically https://github.com/bazelbuild/rules_docker/blob/master/docker/package_managers/run_install.sh.tpl#L21 where there are some volume mounts going on. In the case of a remote docker daemon, it seems the local side of the volume mount is the host machine. I think it's possible to solve this with some docker cp commands that I believe will copy the scripts up to the container before running them. I've not fully hashed this solution out, and it might be too much of a departure from your architecture.

I would be happy to contribute to this project. I've been using rules_docker to create a library of procedurally built container images for use in CI/CD deployments at my job with Nordstrom. You're welcome to dm me anytime to work out a plan for what I can contribute.

I must say that my development experience with Bazel is somewhat limited, but I'm getting the hang of reading and understanding rules and ctx's and whatnot, so I think I could be of some value to this project.

Heres a question: In download_pkgs() The template uses docker run with the expanded commands concated to the end of the command. in install_pkgs() you volume mount the script instead. Why is that?

Thank you for your involvement with this project!

David

[bajacondor]

Here is another thing to note. The install_pkgs() rule ends up running a container with a -v (volume mount) like this:
-v /root/.cache/bazel/_bazel_root/2deb5d73cb7bfe00ce415d97f6b6c0a6/sandbox/linux-sandbox/27/execroot/__main__/bazel-out/k8-fastbuild/bin/ca-certificates.tar:/tmp/bazel-out/k8-fastbuild/bin/ca-certificates.tar
Even if your client and dockerd images can share a context, it's unlikely that they share the rootfs. Is there a way to tell Bazel to use a different dir for files it wants to eventually mount on a container?

[nlopezgi]

Iiuc, the way we get around this is by setting a value for the output_base flag. For instance, when running on GCB, we set this to, e.g., /workspace/output_base. If you have more questions about this, let's open up a separate issue as this two things seem unrelated (imo)

[bajacondor]

That's okay. That works, as long as you can mount that dir with your docker host.

[bajacondor]

Opened a PR but having trouble with the CLA flag. I have an individual CLA, so I'm not sure how to troubleshoot what causing the flag.

[github-actions]

This issue has been automatically marked as stale because it has not had any activity for 180 days. It will be closed if no further activity occurs in 30 days.
Collaborators can add an assignee to keep this open indefinitely. Thanks for your contributions to rules_docker!

[github-actions]

This issue was automatically closed because it went 30 days without a reply since it was labeled "Can Close?"