Bitbucket pipelines authorization denied by plugin pipelines

Question

I am currently trying to build a bitbucket pipeline which is supposed to run a docker-compose file to test a microservice before deployment. The docker compose file is supposed to build my microservice image and run it.

This all seems to work fine locally, however, when I move things to the pipeline I constantly keep getting this error:

#1 [internal] booting buildkit
#1 pulling image moby/buildkit:buildx-stable-1
#1 pulling image moby/buildkit:buildx-stable-1 2.4s done
#1 creating container buildx_buildkit_default 0.0s done
#1 ERROR: Error response from daemon: authorization denied by plugin pipelines: --privileged=true is not allowed
------
 > [internal] booting buildkit:
------
Error response from daemon: authorization denied by plugin pipelines: --privileged=true is not allowed

Dockerfile

FROM node:12-alpine
WORKDIR /app/playground
RUN npm install [email protected]
RUN rm -rf /usr/local/lib/node_modules/npm
RUN mv node_modules/npm /usr/local/lib/node_modules/npm
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
CMD [ "npm", "run", "start" ]

docker-compose.yml

version: "3"
services:
  playground:
    build: .
    ports:
      - 9111:9111
    env_file:
      - ./envs/test.env

I understand that bitbucket pipelines have some mechanism to prevent certain operations from executing for security reasons, but as far as I am aware I am not doing that here.

Any idea of how I could possibly fix this error?

Willin

Would you please share the relevant fragments from your bitbucket-pipelines.yml file? – Scalise

I did run on a similar issue trying to use a buildkit "docker container driver" jira.atlassian.com/browse/… I fear this is an unreported issue with Bitbucket Pipelines. If you would file a new issue, I'd like to follow it. – Scalise

Answer 1

Found 2 working solutions. The more elegant one is to add the following as part of the pipeline script.

- export DOCKER_BUILDKIT=0

Source: https://community.atlassian.com/t5/Bitbucket-discussions/Bitbucket-pipelines-authorization-denied-by-plugin-pipelines/td-p/2147800#M3907

Willin

Answer 2

I encountered this problem as well. If it helps anyone else, the more ideal fix for me was instead:

export PATH=/usr/bin:$PATH

Why this works: Based on my tests and a combination of this announcement and this very detailed support response, my theory is that Pipelines may have implemented support for Buildkit by automatically mounting their own docker binary for you at /usr/bin/docker. The $PATH fix above forces your build to utilize the Pipelines version of Docker instead of whatever version of Docker may have already been installed (e.g. at /usr/local/bin/docker). In my case, the image I was using to perform builds upgraded past v23 which defaulted to BuildKit being enabled (and thus stopped working since you would need to use the Pipelines version if you want BuildKit to work).

Even if you don't want to use BuildKit (i.e. disabled via export DOCKER_BUILDKIT=0), the legacy builder may still be removed in a later version, meaning things might break again. So a better long-term solution might instead be to ensure you're just pointing to the Pipelines version so that things continue working.

Mohock

Answer 3

the solution with export PATH=/usr/bin:$PATH also helped me.

Just add - export PATH=/usr/bin:$PATH to your bitbucket-piplines.yml file.

Example:

script:
        - echo "$DOCKER_REGISTRY_PASSWORD" | docker login $DOCKER_REGISTRY_HOST -u "$DOCKER_REGISTRY_USERNAME" --password-stdin
        - export PATH=/usr/bin:$PATH
        - export DOCKER_BUILDKIT=1
        - docker build -t $DOCKER_REGISTRY_HOST/app:$BITBUCKET_BUILD_NUMBER -f php.dockerfile .

Good luck!

Forestry