Bitbucket pipelines authorization denied by plugin pipelines

[Marian Terchila]

I am currently trying to build a bitbucket pipeline which is supposed to run a docker-compose file to test a microservice before deployment. The docker compose file is supposed to build my microservice image and run it.

This all seems to work fine locally, however, when I move things to the pipeline I constantly keep getting this error:

#1 [internal] booting buildkit
#1 pulling image moby/buildkit:buildx-stable-1
#1 pulling image moby/buildkit:buildx-stable-1 2.4s done
#1 creating container buildx_buildkit_default 0.0s done
#1 ERROR: Error response from daemon: authorization denied by plugin pipelines: --privileged=true is not allowed
------
 > [internal] booting buildkit:
------
Error response from daemon: authorization denied by plugin pipelines: --privileged=true is not allowed

Dockerfile

FROM node:12-alpine
WORKDIR /app/playground
RUN npm install npm@7.1.2
RUN rm -rf /usr/local/lib/node_modules/npm
RUN mv node_modules/npm /usr/local/lib/node_modules/npm
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
CMD [ "npm", "run", "start" ]

docker-compose.yml

version: "3"
services:
  playground:
    build: .
    ports:
      - 9111:9111
    env_file:
      - ./envs/test.env

I understand that bitbucket pipelines have some mechanism to prevent certain operations from executing for security reasons, but as far as I am aware I am not doing that here.

Any idea of how I could possibly fix this error?

[Alexander Prams]

I'm currently having the same error, could you resolve it?

[Marian Terchila]

I have managed to find a working solution to this.

Instead of using build: . in your docker-compose.yml, build the image from the Dockerfile as part of the pipeline and use that image tag in your docker-compose.yml

docker-compose.yml becomes

version: "3"

services:

cases-ms:

image: cases-ms

 pipeline becomes

- step:

name: Unit tests and Snyk scan

image: alpine:3.12

runs-on:

- self.hosted

- linux

services:

- docker

script:

- apk add nodejs npm curl

- curl -SL https://github.com/docker/compose/releases/download/v2.11.2/docker-compose-linux-x86_64 -o /usr/local/bin/docker-compose

- chmod +x /usr/local/bin/docker-compose

- echo //registry.npmjs.org/:_authToken=$NPM_TOKEN_READ_ONLY >> .npmrc

- docker build . -t $BITBUCKET_REPO_SLUG

[Alexander Prams]

Thanks for the followup! I actually also resorted to building with docker build but am also running my 3 containers with docker run separately now, so I was basically rebuilding docker-compose. That was feasible for just 3 containers, but yeah. 

I will try your approach as well :) 

[wrc92]

I was able to get a docker-compose build working by adding this at the beginning of my script:

- export DOCKER_BUILDKIT=0

[Stephan Hohn]

Added 

DOCKER_BUILDKIT=0

as build/repository variable 

[Alessandro Muraro]

Thanks Stephan

[Rich Kalsky]

I too was getting this error:

+ docker build --build-arg SSH_PRIVATE_KEY -t $IMAGE_NAME .
WARNING: No output specified with docker-container driver. Build result will only remain in the build cache. To push result image into registry use --push or to load image into docker use --load
#1 [internal] booting buildkit
#1 pulling image moby/buildkit:buildx-stable-1
#1 pulling image moby/buildkit:buildx-stable-1 3.4s done
#1 creating container buildx_buildkit_default 0.0s done
#1 ERROR: Error response from daemon: authorization denied by plugin pipelines: --privileged=true is not allowed
------
> [internal] booting buildkit:
------
ERROR: Error response from daemon: authorization denied by plugin pipelines: --privileged=true is not allowed

So I added the "export DOCKER_BUILDKIT=0" and that allowed it to build, BUT it says it's deprecated. So now what do I need to do to future-proof my pipeline?

+ docker build --build-arg SSH_PRIVATE_KEY -t $IMAGE_NAME .
bash: warning: command substitution: ignored null byte in input
bash: warning: command substitution: ignored null byte in input
DEPRECATED: The legacy builder is deprecated and will be removed in a future release.
BuildKit is currently disabled; enable it by removing the DOCKER_BUILDKIT=0
environment-variable.

[Matheus Eble]

up

[Somarjun Chandolu]

up

[Mark Bence Kiss]

Same here! 

[Tuomas Pesola]

Same here. Any suggestions?