Docker in Docker dans Kubernetes

apiVersion: batch/v1
kind: Job
metadata:
  name: dind-build-example
  namespace: ci-builds
  labels:
    app.kubernetes.io/name: dind-builder
    app.kubernetes.io/component: build
spec:
  ttlSecondsAfterFinished: 3600  # Nettoyage automatique après 1h
  backoffLimit: 2
  template:
    metadata:
      labels:
        app.kubernetes.io/name: dind-builder
    spec:
      restartPolicy: Never
      serviceAccountName: dind-builder  # ServiceAccount dédié
      
      containers:
      # Conteneur client Docker effectuant le build
      - name: docker-build
        image: docker:24-cli  # Version explicite recommandée
        command: ['sh', '-c']
        args:
          - |
            echo "Waiting for Docker daemon to be ready..."
            timeout 30 sh -c 'until docker info >/dev/null 2>&1; do sleep 1; done'
            echo "Docker daemon ready"
            
            docker build /workspace -t myapp:${CI_COMMIT_SHA:-latest}
            docker images
            
            # Optionnel : push vers registry
            # docker login -u "${REGISTRY_USER}" -p "${REGISTRY_PASSWORD}" registry.example.com
            # docker tag myapp:latest registry.example.com/myapp:latest
            # docker push registry.example.com/myapp:latest
        
        env:
        # Configuration du client Docker pour communiquer via TLS
        - name: DOCKER_HOST
          value: tcp://localhost:2376
        - name: DOCKER_TLS_CERTDIR
          value: /certs
        - name: DOCKER_CERT_PATH
          value: /certs/client
        - name: DOCKER_TLS_VERIFY
          value: "1"
        
        # Variables pour authentification registry (exemple)
        # - name: REGISTRY_USER
        #   valueFrom:
        #     secretKeyRef:
        #       name: registry-credentials
        #       key: username
        # - name: REGISTRY_PASSWORD
        #   valueFrom:
        #     secretKeyRef:
        #       name: registry-credentials
        #       key: password
        
        resources:
          requests:
            cpu: 500m
            memory: 512Mi
          limits:
            cpu: 2000m
            memory: 2Gi
        
        volumeMounts:
        - name: dockerfile-volume
          mountPath: /workspace/Dockerfile
          subPath: Dockerfile
          readOnly: true
        - name: dind-certs
          mountPath: /certs
          readOnly: true
      
      # Daemon Docker en sidecar
      - name: dind-daemon
        image: docker:24-dind  # Version explicite recommandée
        
        securityContext:
          privileged: true  # REQUIS pour DinD
          # Note : privileged=true donne des capacités étendues
        
        args:
        - "--mtu=1400"              # MTU adapté aux overlay networks Kubernetes
        - "--log-level=info"        # Ajuster selon besoin (debug, info, warn, error)
        - "--storage-driver=overlay2"  # Driver recommandé
        
        env:
        - name: DOCKER_TLS_CERTDIR
          value: /certs
        
        resources:
          requests:
            cpu: 500m
            memory: 1Gi
          limits:
            cpu: 2000m
            memory: 4Gi
        
        volumeMounts:
        - name: dind-storage
          mountPath: /var/lib/docker
        - name: dind-certs
          mountPath: /certs
        
        # Healthcheck pour vérifier que le daemon est prêt
        readinessProbe:
          exec:
            command:
            - docker
            - info
          initialDelaySeconds: 10
          periodSeconds: 5
          timeoutSeconds: 3
          failureThreshold: 3
      
      volumes:
      # Stockage éphémère pour le graph storage Docker
      - name: dind-storage
        emptyDir:
          sizeLimit: 10Gi  # Limite de taille pour éviter saturation du nœud
      
      # Partage des certificats TLS entre client et daemon
      - name: dind-certs
        emptyDir:
          medium: Memory  # En mémoire pour performances et sécurité
      
      # ConfigMap contenant le Dockerfile
      - name: dockerfile-volume
        configMap:
          name: dockerfile-configmap
          defaultMode: 0644
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: dockerfile-configmap
  namespace: ci-builds
data:
  Dockerfile: |
    FROM php:8.2-apache
    
    # Installation des dépendances système
    RUN apt-get update && \
        apt-get install --no-install-recommends -y \
          git \
          libicu-dev \
          libxml2-dev \
          libmagickwand-dev \
          unzip \
          vim \
        && apt-get clean \
        && rm -rf /var/lib/apt/lists/*
    
    # Configuration PHP
    RUN docker-php-ext-install intl xml
    
    # Copie des sources (exemple)
    COPY . /var/www/html/
    
    EXPOSE 80

# Créer le Job DinD
kubectl apply -f dind-job.yaml
 
# Suivre les logs du build (conteneur docker-build)
kubectl logs -f job/dind-build-example -c docker-build -n ci-builds
 
# Suivre les logs du daemon Docker
kubectl logs -f job/dind-build-example -c dind-daemon -n ci-builds
 
# Vérifier le statut du Job
kubectl get job dind-build-example -n ci-builds
kubectl describe job dind-build-example -n ci-builds
 
# Inspecter les événements du Pod
kubectl get events --sort-by='.lastTimestamp' -n ci-builds
 
# Accéder au shell du conteneur build pour debug
kubectl exec -it job/dind-build-example -c docker-build -n ci-builds -- sh
 
# Nettoyer le Job et ses Pods
kubectl delete job dind-build-example -n ci-builds

# Vérifier les logs du daemon
kubectl logs <pod-name> -c dind-daemon
 
# Erreurs courantes :
# - permission denied → vérifier privileged: true
# - cannot mount overlay → vérifier support overlay2 sur l'hôte
# - MTU issues → ajuster --mtu

# Vérifier que le daemon est prêt
kubectl exec <pod-name> -c dind-daemon -- docker info
 
# Vérifier la présence des certificats
kubectl exec <pod-name> -c docker-build -- ls -la /certs/client/

kubectl exec <pod-name> -c docker-build -- ping -c 3 registry-1.docker.io

docker system prune -af  # Dans le conteneur