tlsverify - gitlab 管道 - DIND 弃用警告

Question

我正在使用分子来测试我的 Ansible 角色。我正在使用.gitlab-ci.yml 文件来执行一个管道，在该管道中调用 Molecule 来测试角色。管道配置为Docker in Docker。

---
image: docker:latest

services:
  - name: docker:dind
    entrypoint: ["env", "-u", "DOCKER_HOST"]
    command: ["dockerd-entrypoint.sh"]

variables:
  DOCKER_HOST: tcp://docker:2375/
  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: ""

stages:
  - test

<snip>

管道实际上运行没有任何错误，而且我的角色已经过完美测试，这很好。

问题：管道的输出中显示了弃用警告：

2021-12-27T20:54:55.033126585Z time="2021-12-27T20:54:55.032781033Z" level=warning msg="could not change group /var/run/docker.sock to docker: group docker not found"
2021-12-27T20:54:55.035055413Z time="2021-12-27T20:54:55.032907524Z" level=warning msg="Binding to IP address without --tlsverify is insecure and gives root access on this machine to everyone who has access to your network." host="tcp://0.0.0.0:2375"
2021-12-27T20:54:55.035076321Z time="2021-12-27T20:54:55.034207001Z" level=warning msg="Binding to an IP address, even on localhost, can also give access to scripts run in a browser. Be safe out there!" host="tcp://0.0.0.0:2375"
2021-12-27T20:54:56.034494370Z time="2021-12-27T20:54:56.034363786Z" level=warning msg="Binding to an IP address without --tlsverify is deprecated. Startup is intentionally being slowed down to show this message" host="tcp://0.0.0.0:2375"
2021-12-27T20:54:56.034595755Z time="2021-12-27T20:54:56.034566557Z" level=warning msg="Please consider generating tls certificates with client validation to prevent exposing unauthenticated root access to your network" host="tcp://0.0.0.0:2375"
2021-12-27T20:54:56.034665726Z time="2021-12-27T20:54:56.034638945Z" level=warning msg="You can override this by explicitly specifying '--tls=false' or '--tlsverify=false'" host="tcp://0.0.0.0:2375"
2021-12-27T20:54:56.034732887Z time="2021-12-27T20:54:56.034688345Z" level=warning msg="Support for listening on TCP without authentication or explicit intent to run without authentication will be removed in the next release" host="tcp://0.0.0.0:2375"
2021-12-27T20:55:11.036193082Z tim

当我读到这个时，它看起来很严重。

容器本身在 gitlab.com 上执行，我使用共享运行器。 我所有的角色都是为了开发目的，所以我真的不在乎是否有人能读懂它们。无论哪种方式，它们都是开源的。不存储任何生产数据或敏感信息。

问题：如何配置我的管道，以便解决或忽略折旧警告。

我尝试过如下配置：

variables:
  DOCKER_TLSVERIFY: false

但警告仍然存在。

奖励：我应该如何解决：could not change group /var/run/docker.sock to docker: group docker not found

Answer 1

想通了，我必须设置以下变量：

variables:
  # DOCKER_HOST: tcp://docker:2375/ # not used anymore
  DOCKER_DRIVER: overlay2
  DOCKER_TLS_CERTDIR: "/certs"