Skip to content

docker-builds.md

Latest commit

 

History

History
63 lines (47 loc) · 2.09 KB

docker-builds.md

File metadata and controls

63 lines (47 loc) · 2.09 KB
Raw
title Docker Builds
order 20

Docker Builds

The shared tinyland-dind runner provides Docker-in-Docker capability for GitHub Actions jobs that need to build, tag, or push container images.

How It Works

The GitHub ARC tinyland-dind lane launches a docker:dind sidecar service alongside the job container. The Docker daemon runs inside the sidecar, and the job container communicates with it through the injected Docker socket.

  • ARC injects DOCKER_HOST=unix:///var/run/docker.sock for this lane.
  • Do not create repo-specific DinD runner labels for ordinary image builds.
  • Use tinyland-dind directly unless the job needs a different architecture, runtime, privilege, or bounded resource envelope.

Example Job

build-image:
  runs-on: tinyland-dind
  steps:
    - uses: actions/checkout@v6
    - uses: docker/setup-buildx-action@v4
    - run: docker buildx build --load -t my-image:latest .

GitLab DinD compatibility runners may still use a TCP DOCKER_HOST depending on their executor configuration. Do not copy that setting into GitHub ARC jobs unless the live runner contract requires it.

Resource Limits

Container builds are resource-intensive. The tinyland-dind runner is configured with higher limits than the ordinary Docker lane:

  • CPU: 4 cores
  • Memory: 8Gi

These limits apply to the job pod as a whole. If builds fail with out-of-memory errors, see HPA Tuning for how to adjust limits.

Kaniko Alternative

For rootless container builds that do not require a privileged runner, use Kaniko on the standard docker runner. Kaniko builds images in userspace and does not need a Docker daemon. This avoids the security implications of running privileged containers. See Security Model for details on the privilege boundary.

Privileged Mode

The dind runner is the only runner type that runs in privileged mode. This is required because the Docker daemon inside the sidecar needs access to kernel features (cgroups, namespaces) that are unavailable to unprivileged containers.