pipeline: Error response from daemon: authorization denied by plugin pipelines

[Luis Villamarin]

Hi, 

I'm new to bitbucket pipelines. 

I'm trying to build a Knative Function using the pipeline. I am able to install all the dependencies needed for the job. However, when I comes to building the image (Paketo under the hood). I run into this error:

Error: executing lifecycle: failed to create 'creator' container: Error response from daemon: authorization denied by plugin pipelines: -v only supports $BITBUCKET_CLONE_DIR and its subdirectories

Here's how my `bitbucket-pipeline.yml` looks like:

image: lv10/kn-tools:latest

definitions:
  steps:
    - step: &test_function
        name: "Linting, Building and Testing Function"
        services:
          - docker
        caches:
          - docker
        script:
          - export PATH=/usr/bin:$PATH
          - export DOCKER_BUILDKIT=0
          - ACCEPT_EULA=Y apt-get install
          - wget -qo - https://packages.microsoft.com/keys/microsoft.asc
          - apt-key add microsoft.asc
          - make build
          - docker login ${ACR_REGISTRY} --username ${ACR_USER} --password ${ACR_PASSWORD}
          - kn func build --registry ${ACR_REGISTRY} --image ${ACR_REGISTRY}/corp-funcs/monitor-func:dev-0.0.1 -v
          - docker push ${ACR_REGISTRY}/corp-funcs/monitor-func:dev-0.0.1

`kn func build` creates a docker image, in the process of building that image the pipeline fails with the above listed error message. I have tried adding `export PATH=/usr/bin:$PATH` and `export DOCKER_BUILDKIT=0` but that hasn't helped.

Building the image using docker directly is not an option since `kn func build` builds the image in specific way by adding a few dependencies that `knative` needs to run the function.

From what I have read the image will fail to install because bitbucket doesn't support docker run, which `kn func build` apparently does so internally.

Is there a way to get around this apparent limitation of bitbucket-pipelines?

[Nehemias Herrera]

Since last night we began to get this error in our bitbucket pipelines, nothing has changes in out files, we do mount a host folder as a volume, has anything changed ?

we mount volumes in a docker-compose.yml file like this:

```

volumes:

   - ./test-results:/opt/test-results

```

error from docker service:

returned error: authorization denied by plugin pipelines: --mounts is not allowed"

[Patrik S]

Hey @Nehemias Herrera ,

this issue seems to happen only on latest versions of composer (>=2.29.3).

You may be using an docker image that was updated with the new composer version which caused your build to start failing.

In this case, could you try downgrading to composer v2.29.2 or use a different docker image that comes with composer <= 2.29.2 and let us know if the issue persists?

Thank you, @Nehemias Herrera !

Patrik S

[Nehemias Herrera]

@Patrik S thank you for your reply and sorry for not posting before, as you mentioned, it was the latest version of docker, in our case, it was docker:27.2-dind, we solved our issue by using the earlier version docker:27.1-dind 

we were referencing docker:dind, which point to the latest version, we locked it to 

docker:27.1-dind 

[Patrik S]

Hello @Luis Villamarin and welcome to the Community!

The error message you reported is caused because the command you are executing is trying to start a new container and mount a directory inside the container, but since this directory is outside of the 

$BITBUCKET_CLONE_DIR

pipeline is not allowing it.

For security reasons, the pipeline environment does not allow volume mounts outside the clone directory as stated in Docker - Full list of restricted commands.

In this case, you would either have to:

• Configure the command you are executing to mount a directory within the accepted path
  OR
• Execute the build in a self-hosted runner where you can define a custom docker-daemon that does not have the limitation on volume mounting.

Thank you, @Luis Villamarin !
Patrik S

[Luis Villamarin]

Thank you Patrik. I had to move away from Bitbucket, unfortunately there wasn't anyway for me run Knative CLI build or deploy commands. I couldn't specify `$BITBUCKET_CLONE_DIR` for Knative CLI to be aware of.