Update docker in docker configuration to use Unix sockets instead of HTTPS (TLS)

[Link-]

We previously used a TLS socket for the docker in docker (DinD) setup. This was mainly to maintain consistency with the legacy ARC modes.

We reverted to using a Unix socket as it is the preferred approach in: #2833. This method also helps avoid further context configuration with Docker 24.0.6+.

Part of this fix requires the configuration of the group id used by dockerd: reference

This is currently set to the value of 123. The helm charts do not expose any configuration parameters for this value and we will not be. If you need to change this group id or any other parameter for the DinD configuration, you need to create your own charts.

This change is applicable as of gha-runner-scale-0.6.1

[ajschmidt8]

@Link-, @nikola-jokic, @dm3ch for awareness, this breaks things when actions-runner-controller users are using the docker:dind-rootless image.

If you run the docker:dind-rootless image with the --group=123 argument like this:

docker run --name docker --rm -it --privileged docker:dind-rootless --group=123

you can exec into the running image and run ls -ln /run/user/1000/docker.sock to see the following:

srw-rw---T    1 1000     100122           0 Sep 26 21:48 /run/user/1000/docker.sock

The gid is 100122, not 123 as it is with the regular docker:dind image:

srw-rw----    1 0        123              0 Sep 26 21:47 /var/run/docker.sock

The consequence of this is that the runner container receives a permission denied error message when attempting to use the Docker daemon from the docker:dind-rootless container.

If the runner image is intended to be used in tandem with the docker:dind and docker:dind-rootless images, it would be nice if the UID in the runner image (currently 1001) matched the UID in the docker:dind-rootless image (currently 1000). I believe this would address the problem we're experiencing with docker:dind-rootless. docker:dind users could then still use groups to ensure access to the Docker socket.

[ajschmidt8]

cross-referencing #2919 since there are also some related discussions there

[Link-]

Thank you @ajschmidt8 - this is exactly why it's announced and labeled as a breaking change. It's a tricky problem to solve for the following reasons:

1. We never supported docker:dind-rootless (in the new modes) and as such it was never in our consideration, even if it might be a popular choice for a lot of end users.
2. I'm not sure how, with the current charts: "docker:dind users could then still use groups to ensure access to the Docker socket." can be applied
3. We don't want to expose the groups configuration through the helm charts, otherwise there's no end to all the customisations
4. You can always disable dind mode and configure your dind-rootless container whichever way you desire without relying on what we inject!