Remove Docker-in-Docker from builds

examples/builds/docker-build.json

@@ -0,0 +1,9 @@
+{
+  "kind": "Build",
+  "apiVersion": "v1beta1",
+  "input": {
+    "type": "docker",
+    "sourceURI": "https://raw.githubusercontent.com/openshift/origin/master/examples/builds/images/docker-build/Dockerfile",
+    "imageTag": "openshift/docker-build-example"
+  }
+}

examples/builds/images/docker-build/Dockerfile

@@ -0,0 +1,2 @@
+FROM busybox:latest
+CMD echo "success"

examples/builds/sti-build.json

@@ -0,0 +1,10 @@
+{
+  "kind": "Build",
+  "apiVersion": "v1beta1",
+  "input": {
+    "type": "sti",
+    "sourceURI": "https://raw.githubusercontent.com/openshift/origin/master/examples/builds/images/docker-build/Dockerfile",
+    "imageTag": "openshift/sti-build-example",
+    "builderImage": "ncdc/sti-busybox"
+  }
+}

hack/build-images.sh

@@ -18,7 +18,6 @@ cd "${OS_REPO_ROOT}"
 version=$(gitcommit)
 kube_version=$(go run ${hackdir}/version.go ${hackdir}/../Godeps/Godeps.json github.com/GoogleCloudPlatform/kubernetes/pkg/api)
 
-docker build -t openshift/kubernetes-fedora-dind images/builder/docker/kubernetes-fedora-dind
 docker build -t openshift/docker-builder images/builder/docker/docker-builder
 docker build -t openshift/sti-builder images/builder/docker/sti-builder
 docker build -t openshift/hello-openshift examples/hello-openshift

images/builder/docker/docker-builder/Dockerfile

@@ -1,4 +1,4 @@
-FROM openshift/kubernetes-fedora-dind
-RUN yum -y install git
+FROM fedora:20
+RUN yum -y install docker-io git
 ADD ./build.sh /tmp/build.sh
 CMD ["/tmp/build.sh"]

images/builder/docker/docker-builder/build.sh

@@ -2,32 +2,11 @@
 set -uo pipefail
 IFS=$'\n\t'
 
-NEED_DIND=false
-if [ ! -e /var/run/docker.sock ]; then
-  NEED_DIND=true
-fi
-
-if $NEED_DIND; then
-  DOCKER_READY=false
-  dind &
-
-  # wait for docker to be available
-  ATTEMPTS=0
-  while [ $ATTEMPTS -lt 10 ]; do
-    docker version &> /dev/null
-    if [ $? -eq 0 ]; then
-      DOCKER_READY=true
-      break
-    fi
+DOCKER_SOCKET=/var/run/docker.sock
 
-    let ATTEMPTS=ATTEMPTS+1
-    sleep 1
-  done
-
-  if ! $DOCKER_READY; then
-    echo 'Docker-in-Docker daemon not accessible'
-    exit 1
-  fi
+if [ ! -e $DOCKER_SOCKET ]; then
+  echo "Docker socket missing at $DOCKER_SOCKET"
+  exit 1
 fi
 
 TAG=$BUILD_TAG
@@ -40,7 +19,3 @@ docker build --rm -t $TAG $DOCKER_CONTEXT_URL
 if [ -n "$DOCKER_REGISTRY" ]; then
   docker push $TAG
 fi
-
-if $NEED_DIND; then
-  kill -15 $(cat /var/run/docker.pid)
-fi

images/builder/docker/sti-builder/Dockerfile

@@ -1,5 +1,5 @@
-FROM openshift/kubernetes-fedora-dind
-RUN yum -y install golang golang-src golang-pkg-bin-linux-amd64 golang-pkg-linux-amd64 git && \
+FROM fedora:20
+RUN yum -y install docker-io golang golang-src golang-pkg-bin-linux-amd64 golang-pkg-linux-amd64 git && \
     yum clean all
 
 RUN mkdir -p /tmp/go/src/github.com/openshift

images/builder/docker/sti-builder/build.sh

@@ -1,33 +1,10 @@
 #!/bin/bash -ex
 
-NEED_DIND=false
-if [ ! -e /var/run/docker.sock ]; then
-  NEED_DIND=true
-fi
-
-if [ $NEED_DIND == "true" ]; then
-  DOCKER_READY=false
-  dind &
-
-  # wait for docker to be available
-  ATTEMPTS=0
-  while [ $ATTEMPTS -lt 10 ]; do
-    set +e
-    docker version &> /dev/null
-    if [ $? -eq 0 ]; then
-      DOCKER_READY=true
-      break
-    fi
-    set -e
+DOCKER_SOCKET=/var/run/docker.sock
 
-    let ATTEMPTS=ATTEMPTS+1
-    sleep 1
-  done
-
-  if [ $DOCKER_READY != "true" ]; then
-    echo 'Docker-in-Docker daemon not accessible'
-    exit 1
-  fi
+if [ ! -e $DOCKER_SOCKET ]; then
+  echo "Docker socket missing at $DOCKER_SOCKET"
+  exit 1
 fi
 
 TAG=$BUILD_TAG
@@ -46,7 +23,3 @@ TMPDIR=$BUILD_TEMP_DIR sti build $SOURCE_URI $BUILDER_IMAGE $TAG $REF_OPTION
 if [ -n "$DOCKER_REGISTRY" ]; then
   docker push $TAG
 fi
-
-if [ $NEED_DIND == "true" ]; then
-  kill -15 $(cat /var/run/docker.pid)
-fi

pkg/build/doc.go

@@ -1,4 +1,29 @@
-// Package build contains a build system defined on top of Kubernetes.
-// It consists of two resource types: Build and BuildConfig, along with
-// associated storage, as well as a controller that manages states of existing builds
+/*
+Package build contains the OpenShift build system.
+
+It defines a Build resource type, along with associated storage and a controller
+that executes builds and manages states of existing builds.
+
+For newly created builds, the BuildController will assign a pod ID to the build
+and set the build’s state to pending. This way, the assignment of the pod ID and
+pending status is idempotent and won’t result in two BuildControllers
+potentially scheduling two different pods for the same build.
+
+For pending builds, the BuildController will attempt to create a pod to perform
+the build. If the creation succeeds, it sets the build’s status to pending. If
+the pod already exists, that means another BuildController already processed
+this build in a pending state, resulting in a no-op. Any other pod creation
+error would result in the build’s status being set to failed.
+
+For running builds, the BuildController will monitor the status of the pod. If
+the pod is still running and the build has exceeded its allotted execution time,
+the BuildController will consider it failed. If the pod is terminated, the
+BuildController will examine the exit codes for each of the pod’s containers. If
+any exit code is non-zero, the build is marked as failed. Otherwise, it is
+considered complete (successful).
+
+Once the build has reached a terminal state (complete or failed), the
+BuildController will delete the pod associated with the build. In the future, it
+will be desirable to keep a record of the pod’s containers’ logs.
+*/
 package build

pkg/build/strategy/docker.go

@@ -6,16 +6,13 @@ import (
 )
 
 // DockerBuildStrategy creates Docker build using a docker builder image
-// useHostDocker determines whether the minion Docker daemon is used for the build
-// or a separate Docker daemon is run inside the container
 type DockerBuildStrategy struct {
 	dockerBuilderImage string
-	useHostDocker      bool
 }
 
 // NewDockerBuildStrategy creates a new DockerBuildStrategy
-func NewDockerBuildStrategy(dockerBuilderImage string, useHostDocker bool) *DockerBuildStrategy {
-	return &DockerBuildStrategy{dockerBuilderImage, useHostDocker}
+func NewDockerBuildStrategy(dockerBuilderImage string) *DockerBuildStrategy {
+	return &DockerBuildStrategy{dockerBuilderImage}
 }
 
 // CreateBuildPod creates the pod to be used for the Docker build
@@ -38,13 +35,12 @@ func (bs *DockerBuildStrategy) CreateBuildPod(build *buildapi.Build, dockerRegis
 							{Name: "DOCKER_CONTEXT_URL", Value: build.Input.SourceURI},
 							{Name: "DOCKER_REGISTRY", Value: dockerRegistry},
 						},
-						Privileged: true,
 					},
 				},
 			},
 		},
 	}
 
-	setupDockerSocket(bs.useHostDocker, pod)
+	setupDockerSocket(pod)
 	return pod, nil
 }

pkg/build/strategy/docker_test.go

@@ -9,7 +9,7 @@ import (
 
 func TestDockerCreateBuildPod(t *testing.T) {
 	const dockerRegistry = "docker-test-registry"
-	strategy := NewDockerBuildStrategy("docker-test-image", false)
+	strategy := NewDockerBuildStrategy("docker-test-image")
 	expected := mockDockerBuild()
 	actual, _ := strategy.CreateBuildPod(expected, dockerRegistry)
 
@@ -30,9 +30,6 @@ func TestDockerCreateBuildPod(t *testing.T) {
 	if container.RestartPolicy != "runOnce" {
 		t.Errorf("Expected runOnce, but got %s!", container.RestartPolicy)
 	}
-	if !container.Privileged {
-		t.Errorf("Expected Privileged")
-	}
 	if e := container.Env[0]; e.Name != "BUILD_TAG" && e.Value != expected.Input.ImageTag {
 		t.Errorf("Expected %s, got %s:%s!", expected.Input.ImageTag, e.Name, e.Value)
 	}