pipeline: Error response from daemon: authorization denied by plugin pipelines

[Luis Villamarin]

Hi, 

I'm new to bitbucket pipelines. 

I'm trying to build a Knative Function using the pipeline. I am able to install all the dependencies needed for the job. However, when I comes to building the image (Paketo under the hood). I run into this error:

Error: executing lifecycle: failed to create 'creator' container: Error response from daemon: authorization denied by plugin pipelines: -v only supports $BITBUCKET_CLONE_DIR and its subdirectories

Here's how my `bitbucket-pipeline.yml` looks like:

image: lv10/kn-tools:latest

definitions:
  steps:
    - step: &test_function
        name: "Linting, Building and Testing Function"
        services:
          - docker
        caches:
          - docker
        script:
          - export PATH=/usr/bin:$PATH
          - export DOCKER_BUILDKIT=0
          - ACCEPT_EULA=Y apt-get install
          - wget -qo - https://packages.microsoft.com/keys/microsoft.asc
          - apt-key add microsoft.asc
          - make build
          - docker login ${ACR_REGISTRY} --username ${ACR_USER} --password ${ACR_PASSWORD}
          - kn func build --registry ${ACR_REGISTRY} --image ${ACR_REGISTRY}/corp-funcs/monitor-func:dev-0.0.1 -v
          - docker push ${ACR_REGISTRY}/corp-funcs/monitor-func:dev-0.0.1

`kn func build` creates a docker image, in the process of building that image the pipeline fails with the above listed error message. I have tried adding `export PATH=/usr/bin:$PATH` and `export DOCKER_BUILDKIT=0` but that hasn't helped.

Building the image using docker directly is not an option since `kn func build` builds the image in specific way by adding a few dependencies that `knative` needs to run the function.

From what I have read the image will fail to install because bitbucket doesn't support docker run, which `kn func build` apparently does so internally.

Is there a way to get around this apparent limitation of bitbucket-pipelines?

[Patrik S]

Hello @Luis Villamarin and welcome to the Community!

The error message you reported is caused because the command you are executing is trying to start a new container and mount a directory inside the container, but since this directory is outside of the 

$BITBUCKET_CLONE_DIR

pipeline is not allowing it.

For security reasons, the pipeline environment does not allow volume mounts outside the clone directory as stated in Docker - Full list of restricted commands.

In this case, you would either have to:

• Configure the command you are executing to mount a directory within the accepted path
  OR
• Execute the build in a self-hosted runner where you can define a custom docker-daemon that does not have the limitation on volume mounting.

Thank you, @Luis Villamarin !
Patrik S