docker group ID keeps changing in self-hosted runners

[mem]

Using the self-hosted runners, I ran into an issue where the ID of the docker group was relevant in order to implement a workaround. The details of that problem are not relevant, just that the ID of the docker group was needed.

In the last day or two, something changed (I imagine the image deployed to the self-hosted runners) and the ID of the docker group changed again.

As I write this, the GID on arm64 is 116 and on amd64 it's 117.

Without having looked at the process used to create the images, I can guess it involves installing the docker package on Unbuntu. The configure step of that package's installtion includes this:

            # Make sure the "docker" system group exists for "docker.socket"
            # to apply it as the group on "docker.sock"
            if ! getent group docker >/dev/null 2>&1 ; then
                addgroup --system docker
            fi

the call to addgroup will create the docker group and it will assign the next available gid, this is the reason why the id keeps changing.

Again, without having looked at how the images are built, this is fixed by creating the docker group before installing the docker package, and assigning a fixed GID to it.

[iainlane]

I have moved this to https://github.com/grafana/runner-images, where we build the images.

One thing that might help (since I'm triaging the issue) is if you could explain what you're doing that needs the numeric IDs.

[zerok]

@mem ping 🙂

[guicaulada]

I looked into an issue related to this quickly after the image update.

The chosen approach was to retrieve the docker GID dynamically.

It's hard to ensure that the group ID remains the same based on installation order alone, Docker is installed by this script which also handles the group creation, since the images are created to be compatible with upstream and use the Ubuntu images on AWS as base, this ID could change any time due to changes on the base image on AWS, upstream updates or new tools being added to the image.

While looking into that file however, I noticed these lines from upstream:

# docker from official repo introduced different GID generation: https://github.com/actions/runner-images/issues/8157
gid=$(cut -d ":" -f 3 /etc/group | grep "^1..$" | sort -n | tail -n 1 | awk '{ print $1+1 }')
groupmod -g "$gid" docker

So we could possibly modify this to ensure the ID is always the same.