[pipelines] Cannot use `DockerImage.fromAsset()` as CodeBuild environment

The SelfMutate action fails with the error Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

My pipeline uses a custom build image in the Build stage through codebuild.LinuxBuildImage.fromAsset. This requires building and publishing the build image in the SelfMutate action.

This is likely due to missing privileged: true in the SelfMutation CodeBuild project:

https://github.com/aws/aws-cdk/blob/bf1c1c197bae895bba4ff5088b03d4e9b7d1692f/packages/%40aws-cdk/pipelines/lib/actions/update-pipeline-action.ts#L59-L76

Reproduction Steps

const buildProject = new codebuild.PipelineProject(this, 'BuildProject', {
  buildSpec: codebuild.BuildSpec.fromSourceFilename('buildspec.yml'),
  environment: {
    buildImage: codebuild.LinuxBuildImage.fromAsset(this, 'BuildImage', {
      directory: path.join(__dirname, 'build-image'),
    }),
  },
});
const synthAction = new codepipeline_actions.CodeBuildAction({
  actionName: 'Build',
  project: buildProject,
  input: sourceArtifact,
  outputs: [cloudAssemblyArtifact],
});

What did you expect to happen?

The SelfMutate action can invoke Docker to build the custom build image.

What actually happened?

The SelfMutate action could not invoke Docker.

Error trace:

PipelineStack: deploying...
--
PipelineStack: deploying...
Assuming role 'arn:aws:iam::XXXXXXXXXXXX:role/cdk-hnb659fds-deploy-role-XXXXXXXXXXXX-eu-central-1'.
Waiting for stack CDKToolkit to finish creating or updating...
[0%] start: Publishing e8b2cd44815671370f30cd36ed6bf04788aadc936896ce7e63d94822c137c429:XXXXXXXXXXXX-eu-central-1
Retrieved account ID XXXXXXXXXXXX from disk cache
Assuming role 'arn:aws:iam::XXXXXXXXXXXX:role/cdk-hnb659fds-file-publishing-role-XXXXXXXXXXXX-eu-central-1'.
[0%] check: Check s3://cdk-hnb659fds-assets-XXXXXXXXXXXX-eu-central-1/e8b2cd44815671370f30cd36ed6bf04788aadc936896ce7e63d94822c137c429
[0%] upload: Upload s3://cdk-hnb659fds-assets-XXXXXXXXXXXX-eu-central-1/e8b2cd44815671370f30cd36ed6bf04788aadc936896ce7e63d94822c137c429
[50%] success: Published e8b2cd44815671370f30cd36ed6bf04788aadc936896ce7e63d94822c137c429:XXXXXXXXXXXX-eu-central-1
[50%] start: Publishing a67245d91d0552ef5f12da7797006b386702cfa0b2002a65f8435b728b249199:XXXXXXXXXXXX-eu-central-1
Retrieved account ID XXXXXXXXXXXX from disk cache
Assuming role 'arn:aws:iam::XXXXXXXXXXXX:role/cdk-hnb659fds-image-publishing-role-XXXXXXXXXXXX-eu-central-1'.
Retrieved account ID XXXXXXXXXXXX from disk cache
[50%] check: Check XXXXXXXXXXXX.dkr.ecr.eu-central-1.amazonaws.com/cdk-hnb659fds-container-assets-XXXXXXXXXXXX-eu-central-1:a67245d91d0552ef5f12da7797006b386702cfa0b2002a65f8435b728b249199
Call failed: describeImages({"repositoryName":"cdk-hnb659fds-container-assets-XXXXXXXXXXXX-eu-central-1","imageIds":[{"imageTag":"a67245d91d0552ef5f12da7797006b386702cfa0b2002a65f8435b728b249199"}]}) => The image with imageId {imageDigest:'null', imageTag:'a67245d91d0552ef5f12da7797006b386702cfa0b2002a65f8435b728b249199'} does not exist within the repository with name 'cdk-hnb659fds-container-assets-XXXXXXXXXXXX-eu-central-1' in the registry with id 'XXXXXXXXXXXX'
[50%] debug: docker login --username AWS --password-stdin https://XXXXXXXXXXXX.dkr.ecr.eu-central-1.amazonaws.com
[50%] debug: docker inspect cdkasset-a67245d91d0552ef5f12da7797006b386702cfa0b2002a65f8435b728b249199
[50%] build: Building Docker image at /codebuild/output/src189637107/src/asset.a67245d91d0552ef5f12da7797006b386702cfa0b2002a65f8435b728b249199
[50%] debug: docker build --tag cdkasset-a67245d91d0552ef5f12da7797006b386702cfa0b2002a65f8435b728b249199 .
Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
[100%] fail: docker build --tag cdkasset-a67245d91d0552ef5f12da7797006b386702cfa0b2002a65f8435b728b249199 . exited with error code 1: Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?

 ❌  PipelineStack failed: Error: Failed to publish one or more assets. See the error messages above for more information.
    at Object.publishAssets (/usr/local/lib/node_modules/aws-cdk/lib/util/asset-publishing.ts:25:11)
    at CloudFormationDeployments.publishStackAssets (/usr/local/lib/node_modules/aws-cdk/lib/api/cloudformation-deployments.ts:262:7)
    at CloudFormationDeployments.deployStack (/usr/local/lib/node_modules/aws-cdk/lib/api/cloudformation-deployments.ts:154:5)
    at CdkToolkit.deploy (/usr/local/lib/node_modules/aws-cdk/lib/cdk-toolkit.ts:180:24)
    at initCommandLine (/usr/local/lib/node_modules/aws-cdk/bin/cdk.ts:200:9)
Failed to publish one or more assets. See the error messages above for more information.
Error: Failed to publish one or more assets. See the error messages above for more information.
    at Object.publishAssets (/usr/local/lib/node_modules/aws-cdk/lib/util/asset-publishing.ts:25:11)
    at CloudFormationDeployments.publishStackAssets (/usr/local/lib/node_modules/aws-cdk/lib/api/cloudformation-deployments.ts:262:7)
    at CloudFormationDeployments.deployStack (/usr/local/lib/node_modules/aws-cdk/lib/api/cloudformation-deployments.ts:154:5)
    at CdkToolkit.deploy (/usr/local/lib/node_modules/aws-cdk/lib/cdk-toolkit.ts:180:24)
    at initCommandLine (/usr/local/lib/node_modules/aws-cdk/bin/cdk.ts:200:9)

[Container] 2020/11/11 16:06:30 Command did not exit successfully cdk -a . deploy PipelineStack --require-approval=never --verbose exit status 1
[Container] 2020/11/11 16:06:30 Phase complete: BUILD State: FAILED
[Container] 2020/11/11 16:06:30 Phase context status code: COMMAND_EXECUTION_ERROR Message: Error while executing command: cdk -a . deploy PipelineStack --require-approval=never --verbose. Reason: exit status 1
[Container] 2020/11/11 16:06:30 Entering phase POST_BUILD

Environment

• CDK CLI Version : 1.73
• Framework Version: 1.73

---

This is 🐛 Bug Report

[rix0rrr]

It is true that this requires a privilegedMode flag on the SelfMutate action. Feels a little dangerous/unnecessary to enable this by default. It will have to become a parameter.

[github-actions[bot]]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see. If you need more assistance, please either tag a team member or open a new issue that references this one. If you wish to keep having a conversation with other community members under this issue feel free to do so.